[OpenAFS-devel] token passing in modern ssh?

[Jim Rees]

  There is not currently any mechanism defined that will allow forwarding of 
  credentials or AFS tokens other than as a side-effect of GSSAPI 
  authentication.

You can forward your tgt, and use that to obtain a token on the remote side.
But that only works for a single realm/cell.  I could get what I want if it
were possible to obtain tgts in multiple realms, but for some reason MIT
apparently didn't think that would be useful.