Your interface looks good as far as I am concerned. I do wonder whether the get and free pa_opt functions belong in the preauth plugin header rather than krb5.hin.