Fixed kerberos path again. Default Ubuntu installs do indeed use /var/lib/krb5kdc. Really should try to autodetect that.
AuthType WebAuth
Require valid-user
<FilesMatch "^((webauth-)?logout|lostpw|pw-strength)(\.php)?$">
Require valid-user
Satisfy Any
AuthType None
</FilesMatch>
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([^/]*)(/.*)?$ $1.php$2 [L,QSA]