SimonWilkinson/gss-openssh — pull request #1 by achernya (2013-04-24 21:51:22+00:00)
Title: Optionally require that tickets be forwarded

In some systems, such as the MIT athena.dialup.mit.edu servers, AFS is
used for home directories. AFS requires that Kerberos tickets are
available to be converted to "tokens", so that files can be then be
accessed. For a system that allows authentication via
GSSAPIAuthenication, it's possible to get into a state where a user
has successfully logged in, but then cannot read any files. To
prevent this confusion, allow the system administrator to specify
"GSSAPIRequireDelegatedCredentialsFor" with a group to force those
users to also provide GSSAPIDelegateCredentials, or else drop down to
keyboard-interactive/password authenication, which would allow a
properly-configured PAM stack to then get tickets and tokens.

This does not change any behavior of gss-openssh unless explicitly
enabled by the system administrator.