I just found out that what I wrote back then isn’t true anymore. I don’t know why it worked back then, but I just set up another test machine and SSO didn’t work until I appended the following lines to the krb5.conf like it’s described in the official SSO documentation:
[realms]
MY-DOMAIN.COM = {
kdc = dc.my-domain.com
admin_server = dc.my-domain.com
default_domain = my-domain.com
}