I was able to make this work. The key was that the jboss servers need to login to kerberos with a user id that has the SPN of the webserver registered to it. The kerberos should be a dedicated user whose password doesn't expire. This was just a regular user, not a machine trust account.

I'm using domain mode. Given the following:

  Kerberos Realm: COMPANY.COM

  AD Domain: COMPANY

  webserver running mod_cluster: webserver.company.com

  jboss master: jbossmaster.company.com

  jboss slave1: jbossslave1.company.com

  user account whose password doesn't expire: jbossuser, or COMPANY\jbossuser

1. register the webserver SPN & create a keytab file

  ktpass -princ HTTP/webserver.company.com@COMPANY.COM -pass jbpassword -kvno 0 -mapuser COMPANY\jbossuser -out c:\jboss.keytab -ptype KRB5_NT_PRINCIPAL

2. store password for register for java (ktab is part of jdk, use the same jdk version as your jboss server)

   ktab.exe -k c:\jboss.keytab -a jbossuser@COMPANY.COM

3. transfer c:\jboss.keytab to jbossmaster and jbossslave1

4. add something like this to your domain.xml security subsystem:

<security-domain name="host" cache-type="default">

                    <authentication>

                              <login-module code="Kerberos" flag="required">

                                        <module-option name="doNotPrompt" value="true" />

                                        <module-option name="storeKey" value="true" />

                                        <module-option name="useKeyTab" value="true" />

                                        <module-option name="useTicketCache" value="true" />

                                        <module-option name="debug" value="true" />

                                        <module-option name="keyTab" value="/path/to/jboss.keytab" />

                                        <module-option name="principal" value="HTTP/webserver.company.com" />

                              </login-module>

                    </authentication>

          </security-domain>

          <security-domain name="app-security-domain" cache-type="default">

                    <authentication>

                              <!-- allow, but do not require, password-based logins -->

                              <login-module code="RealmDirect" flag="sufficient">

                                        <module-option name="password-stacking" value="useFirstPass" />

                              </login-module>

                              <login-module code="SPNEGO" flag="sufficient">

                                        <module-option name="password-stacking" value="useFirstPass" />

                                        <module-option name="serverSecurityDomain" value="host" />

                                        <module-option name="removeRealmFromPrincipal" value="true" />

                                        <module-option name="debug" value="true" />

                              </login-module>

                    </authentication>

                    <mapping>

                              <!-- you'll need to get roles from something else like ldap, database,

                                        whatever -->

                              <!-- here we take static role mappings from jboss-web.xml -->

                              <mapping-module code="DeploymentRoles" type="role" />

                    </mapping>

          </security-domain>

5. if you use DeploymentRoles mapping provider, add something like this to jboss-web.xml

<security-role>

                    <role-name>AdminRole</role-name>

                    <principal-name>admin</principal-name>

                    <principal-name>developer</principal-name>

          </security-role>

          <security-role>

                    <role-name>UserRole</role-name>

                    <principal-name>admin</principal-name>

                    <principal-name>developer</principal-name>

          </security-role>

          <security-role>

                    <role-name>DeploymentRole</role-name>

                    <principal-name>admin</principal-name>

                    <principal-name>developer</principal-name>

          </security-role>

Also, I did set the system properties java.security.krb5.kdc & java.security.krb5.realm. This isn't stricly necessary but for us (we have a large global AD network) i needed to point to a local server rather than jumping around the globe.

If you run into trouble, setting the system properties javax.net.debug & sun.security.krb5.debug were extremely helpful.