The Kerberos single sign-on (SSO) extension on macOS Catalina10.15 will log users into native apps (for apps that support Kerberos authentication) and sync local user passwords with a directory service such as Microsoft Active Directory. With the Kerberos SSO extension, users do not have to provide their user name and password to access native apps, file servers, proxy servers, and URLs that support Kerberos authentication. The Kerberos SSO extension is sandboxed (this guide explains the ramifications of sandboxing) and requires a mobile device management (MDM) solution (that supports the Extensible Single Sign-on (SSO) configuration profile payload) to enable the extension.
