Shibboleth Developers

["Scott Cantor" <>]

> The applications that receive the proxy token treat the proxy token just
> like a password.  The applications just pass it to the backend servers,
> which have a PAM module to support it.  Does that answer your question?

If it's treated like a password, then what's the significance of Kerberos to
this use case? Couldn't any attribute be used like this already?

It seems odd to overcomplicate the code with Kerberos if you're bypassing
the cryptographic parts. Or maybe I'm still not getting it.

-- Scott