This is an Apple-specific mechanism for keeping Kerberos passwords  
synchronized with other authentication mechanisms.  Unfortunately,  
there really isn't any documentation to cite here.

On Aug 24, 2007, at 1:57 PM, Ken Raeburn via RT wrote:

> This could use a little more explanation too.  What's it do?  Are  
> there protocol specs that should
> be referenced?
>
> Also, a plugin mechanism might be a better general approach than  
> Apple-PWS-specific code in
> the main KDC body.