ActiveDirectory (Windows) specific claims should be added when using Negotiate Kerberos auth under Linux implementation.

primarysid
primarygroupsid
groupsid
denyonlysid

Under Linux, claims described above are currently received using LDAP.
Kerberos has mechanisms to avoid any additional queries to get group SIDs and user SIDs.
However, currently under Linux the only claim receivced without using LDAP is name claim.