What is there for users to figure out? If you setup kerberized login, users will get tickets at login. And many apps (email, ssh, web browsers, etc) support kerberos already.