@serg , I understand that most of the Windows internal stuff might be uninteresting, but I'd like to have a feedback on functionality, as well as on suggested syntax with GROUP: and SID: prefixes.
Hi @vlad, I think it would also be useful, if one could authenticate with more than one group, like for instance:
CREATE USER root IDENTIFIED VIA gssapi as 'GROUP:Administrators' OR gssapi as 'GROUP:OtherGroup'
CREATE USER root IDENTIFIED VIA gssapi as 'GROUP:Administrators,GROUP:OtherGroup'
I definitely could make use of this – just as additional input/idea. I know that MySQL supports defining multiple groups this way.
Kunde I thought the first of your proposals would already work , or would not it? With 2 Kerberos handshakes, admittedly, this would be somewhat slower.
The second of your proposals, would not it be simple/preferable to handle things on the AD site, e.g create a group contains both Administrators and OtherGroup, call it MariaDBRootGroup?
I mean, now you're satisfied with groups separated by "," meaning OR, but tomorrow you might want an AND (member of both groups), and next day NOT (member of one group, but not another one), so we could end up creating own full-featured domain specific language just for "IDENTIFIED VIA gssapi AS" 
The first proposal (see it as two syntax options) already works with UPNs, correct – I only wanted to mention it here as possible use case. It can be useful if two user-groups should access one service, but in general you're right that this can be done on AD site as well.
From a logical perspective it always means OR, of course neither AND nor NOT – I get your point.