                           pam-krb5 To-Do List

 * Support the remaining PAM options that the Sourceforge module supports.
   The most interesting are banner, keytab, and ticket_lifetime.

 * Support expose_account in the PAM configuration and, when set, use the
   native Kerberos prompters that give more information about what account
   the user is authenticating to.

 * Call krb5_aname_to_localname on the provided username (if search_k5login
   is not enabled) and store the result back in PAM_USER.  This lets people
   log in with a full principal name.  It's not clear how useful this is,
   but there's no reason not to support it.

 * pam_sm_acct_mgt should probably require a Kerberos ticket cache, pull
   the principal from it, and call kuserok on that rather than trusting
   PAM_USER.
