#CoSoTech gang, I need some #Linux help.

I've got some RHEL 7/8 systems joined to an AD domain via SSSD. Now I'm tasked with setting it up so that when users log in with their AD creds, they get a homedir mounted from a network share (either a Linux NFS server or a Windows CIFS/NFS one, I don't care) using Kerberos auth.

I'm struggling to find a clean way of making this work without compromising on security. (Sure, I could just automount NFS without auth and have a day, but eww.)

Ideas?