>2) you could try to rework the overlay to avoid any specific reference >to Active Directory, since your cache should apply to any remote >system >implementing Kerberos V. It could be abstracted even more, to act >as a >replacement of saslauthd, by allowing it to auth via LDAP, pam and >more, >not just Kerberos. s/to act as a replacement/to defer external authentication to saslauthd or the like/ In slapd(8), we deferred verification against external password stores to saslauthd via the {SASL} userPassword mechanism, thus avoiding needing to implement and support each possible external password store (such as a KDC). This module should likewise avoid supporting (some subset of) external passwords stores. saslauthd(8) can easily be extended (or replaced) to support additional password stores as needed. As provided in Cyrus SASL today, it supports both LDAP and Kerberos as external password stores.