It seems to me a bigger problem that the code doesn't deal with service tickets with shorter lifetime than the TGT. I'd recommend getting a full lifetime ticket and also causing the ccache routines not to return expired tickets when being called by something like mk_req.