With the current authentication provider interface, it does not seem possible to implement password-less authentication. I use mod_auth_gssapi with other services (like nextcloud, ampache...) and I would like to use it with phpBB as well.