[OpenAFS-port-darwin] Tokens on login via ssh?

[bil]

I'm trying to get 10.4 systems to obtain afs tokens when a user logs in 
remotely via ssh. In the past I've done this with pam_afs.so.1. I've 
managed to hack that from some source David Botsch provided for 10.2 well 
enough so that it builds, and when I install that module, it is apparently 
authenticating against afs (since I can login, and the password prompt is 
"AFS Password", and most importantly, if I give it a bad password I can't 
login). But I'm not getting tokens.

This is against OpenSSH_3.8.1p1 provided in 10.4 against a K4 afs cell.

I have found some emails via google that suggest this behaviour might be 
due to the version of sshd (3.6 might work?), but I'd rather use a more 
recent ssh than that.

I've been poking around for alternatives, but I figured before I ran down 
too many rabbit holes, I should ask, what are other folks doing for this? 
Is there a way to authenticate agains k4 or k5 and also get tokens?

tia,
bil