In pam_krb5 1.x, the pam_krb5afs.so module included support for setting AFS tokens using the user's Kerberos credentials, and the pam_krb5.so module didn't. Since the 2.0 rewrite, the module has instead attempted to do the right thing by default, and pam_krb5afs.so has been a symlink to pam_krb5.so. The "tokens" argument should be unnecessary, too, as applications which either access or provide access to the user's files should be using pam_setcred() or pam_open_session(), either of which will cause tokens to be obtained, by now. (If a workaround is still needed in the field, the "tokens" option can be given a list of PAM service names in /etc/krb5.conf.) For services which don't need the option to work properly, it'll make logins a little bit faster to not have that redundancy there. So we might as well simplify the code in authconfig by taking out the logic which chooses one over the other. I haven't got any immediate plans to remove the symlink from the pam_krb5 package, so this isn't at all urgent.