So, I looked in more detail at krb5_cc_set_config. I misread the API. Storing the cross-realm negotiation information will not be a problem. Thus one reason for preferring option 4 (ticket flag) over the other options does not apply.