Heimdal has a function krb5_get_init_creds_opt_set_pac_request which causes a PA-PAC-REQUEST padata to be included in the AS request, requesting the inclusion or exclusion of a PAC. We should support this as well. See also: http://mailman.mit.edu/pipermail/krbdev/2014-August/012138.html