We've successfully got Kerberos -> Password Fetch working, but having issues with FALLBACK_AUTHCLASS to com.novell.nidp.authentication.local.ProtectedPass wordClass

The com.novell.nidp.authentication.local.ProtectedPass wordClass class (used by Secure Name/Password - Form) has Query property attached to it and works with a Contract that uses the form method.

I've tried also adding Query property to the Kerboros Method, but when a no KT is received, the form fails to login, making the FALLBACK_AUTHCLASS pointless and confusing to end users.

I wish it could be made simpler by having a FALLBACK_CONTRACT=contract/uri on the Kerberos Method so the nidp actually loads that contract, rather than trying to load a backend class that doesn't appear to work.