Re: multimple domain authentication

no, andrey, I think you said it right. You ought to be able to say:  "If I
get a user in here from LANL, then I will delegate the auth function to
LANL. No local resources save CPUs and volatile disk (read:  caching) will
be made available".

Now I remember that was the original plan. So we need a way to delegate 
auth functions from the local domain to Somewhere Else that is trusted. 
How do we do this?

ron