Right; you can't read a password, but you CAN read/write the "pointer" to it, and that's all you need.

Care to explain how to do this?

It can be done via "Workgroup Manager" (GUI; does not require Mac OS X Server) or via command-line - look for the "AuthenticationAuthority" attributes.

It's "advanced" (you won't even see that attribute until you enable WorkGroup Manager's "Inspector") and all the standard warnings apply; you can make a mess of things at this level.