Grab username/domain from a kerberos ticket header

but I don't have any web site or ressource to do the AAA kerberos auth

You don't need any web site or resource to do Kerberos AAA. APM client side Kerberos is constrained to APM itself and has no reliance on backend servers. If you can properly authenticate a browser with Kerberos AAA, using a very basic 401 and Kerberos auth agent in the VPE, the username and domain will be available in the session.logon.last.username as user@REALM.