Validating Users With Expired Passwords

[wiltbank@gmail.com]

Bear with me...

I am a PHP programmer for a college -- I've never had to deal with Perl
up until this moment.  We now need a web-based utility to handle users
with expired passwords; since we use a most mangled form of
authentication using a bloody mesh of PAM, Kerberos and Active
Directory, my best option is to use Perl inside of a PHP page to check
their credentials against Kerberos.

In a nutshell, I need to take a username and an expired password and
see if that truely was the users' last pasword.  Once I'm able to
validate the users' expired information, I already have a system in
place that will change their password through a web-based form...  It's
just the authentication with expired credentials that's killing.

Please understand, I've never dealt with kerberos either until this
point -- I don't know understand how it works or the terms used to
identify various aspects.  I've heard principal and ticket thrown
around, but it's something that's never been explained.  If any one
isn't busy stuffing a pencil in their eye, I'd appreciate any sample
code or direction in this matter;  as much as I'd love to take a couple
of weeks or so and research the topic and the language, my boss just
wants it done now.

Thanks,
Rob.

PS: I don't blame you if, instead of taking the time to answer this
post, you do something more productive like devoting the morning to
clearing out any extra belly button lint.  I know how assinine these
types of posts can be.  My appologies.