libnss-ldap authenticate with host keytab?

I'm working on finalizing our setup here, but have this one remaining issue. I 
can't seem to get libnss-ldap to bind using the krb5.keytab entry for the 
host principal. Am I approaching this from the wrong direction, or am I just 
missing a simple switch?

Anonymous bind is disabled (2003 Server AD), and I would *strongly* like to 
avoid having a readable dn/password in libnss-ldap.conf and thought that 
using the existing host/hosts.fqdn.com principal would be best, either via 
Kerberos directly, or more likely SASL.

I'd appreciate any pointers/comments/ideas.

Joel Johnson