Actually the ticket request needs to have 'request-pac' passed as part of the API to even receive the PAC structure. Currently it doesn't so it would be impossible to implement the authorization independently of this. We would at least need some flag to be able to retrieve the PAC.
2009-08-20 11:05:06 UTC in Kerberos Module For Apache
