Kerberos authentication against FreeIPA - FAST Tunnel support

[Cantor, Scott]

> FreeIPA uses a Kerberos FAST tunnel for OTP authentication
> (https://tools.ietf.org/html/rfc6113). From the command line, running kinit
> fails. We need to run kinit with -T option (armor credential cache).

Do you have any reason to believe the Java implementation of Kerberos supports that?

> How to get this working with Shibboleth IdP ? Any help is appreciated.

I doubt you can, short of writing your own code to invoke native code to get around the above issue.

-- Scott