Ah, I always get confused between authenticator and ap-req. and thought that krb5_auth_gcon_getauthenticator would help. But yes, giving back everything from rd_req sounds good.