Further debugging by printf shows that:On Jessie when libpam_krb5 gets to "pam_sm_setcred: entry (reinit)" the ticket cache name is in the environment (KRB5CCNAME) (the real environment, not the PAM args one).
On Stretch at the same place KRB5CCNAME is unset.
