Further debugging by printf shows that: On Jessie when libpam_krb5 gets to "pam_sm_setcred: entry (reinit)" the ticket cache name is in the environment (KRB5CCNAME) (the real environment, not the PAM args one). On Stretch at the same place KRB5CCNAME is unset.