In a PAM module you wouldn't be using krb5_rd_cred() anyways as there's no peer to send forwarded ticket.