Transparent Kerberos SSO Authentication

[osef]

Hello everyone, 

I'm currently playing with the identity agent and kerberos SSO.

In the identity awarness admin guide, we can read this : 

Can someone explain this feature ? I understand the gateway is going to read the SID in the kerberos ticket but what is the practial benefit ? Is it going to improve the gateway performance when fetching the user's group ?

Thanks !

[PhoneBoy]

It saves the gateway from having to do an LDAP lookup for the user.
Also, the gateway should theoretically pick up group changes faster since Kerberos tickets are exchanged more frequently than LDAP lookups happen.