Whether or not cyrus works with afs now, it does not seem to be a good fit for your scenario. cyrus is a "black box" mail system. All the mail files are owned by the cyrus user and live in filesystem trees designated as cyrus "partitions". The daemons all run as the cyrus user and PAM authentication is delegated to an outside process.