HTTP Transport access KDCs via an HTTPS proxy server, which by-passes firewalls that disallow traffic on port 88 or 749.

MS [1] and MIT krb5 [2] support it.

[1] http://msdn.microsoft.com/en-us/library/hh553774.aspx
[2] http://k5wiki.kerberos.org/wiki/Projects/HTTP_Transport