user substitution using openssh and AD SSO

Hi,

is there a way to let a user substitute himself as another using  
openssh?

For instance, let us say that I want to let Windows user jdoe connect  
via ssh to a Linux machine on which his account does not exist. Can  
you do that in openssh, perhaps using agent forwarding?

Furthermore, can you do Active Directory Single-Sign-On using  
openssh? Do you need Kerberos for that?

Many thanks.

p