How to: OAM Authentication Policy with WNA authN step followed by LDAP authN step?

Greetings,

I wish to create an OAM Authentication Policy to protect resources that would first check if the user has an Active Directory Kerberos ticket and if not challenge the user for username/password for authentication against an LDAP server. How can I achieve this?

I have successfully created a WNA authN policy (using a Kerberos Scheme which in turn uses a native Kerberos module and WNA challenge method) and a LDAP authN policy (using a LDAP Scheme which in turn uses a native LDAP module and FORM challenge method). My first guess is that I could create an authentication policy configured to use a LDAP Scheme and then add a pre-authentication advanced rule that is configured to use a Kerberos Scheme. Does that sound right? If so how would I go about doing this, and particularly how would I fill in the advance rule