Description of problem:
This is more or less copy-n-paste from an e-mail discussion I had with Robbie

I was looking into one issue triggered by OpenSSH with Jakub Jelen and
I think I need your help about behaviour of the difference ccache
types in krb5.

The reproducer for this issue is to log in with SSH's built-in
Kerberos authentication (not PAM). Then, SSH internally manages the
ccache.

There are only two calls that even concern the ccache before the issue
appears. First, openssh calls krb5_cc_new_unique() which calls into
kcm_gen_new(). Next, openssh calls krb5_cc_switch(), which calls into
kcm_switch_to() on the krb5 side.

And here is what I'm confused about -- looking at the libkrb5 code,
calling gen_new with other ccaches (I took DIR as an example) also
creates the ccache, but not with KCM.

If you look at dcc_gen_new() then it calls verify_dir() which actually
creates the DIR structure. The other call to verify_dir() in the dir
ccache code is in dcc_resolve(). This makes sense to me.

However, looking at the kcm ccache code, kcm_gen_new only invokes the
KCM_OP_GEN_NEW operation of the KCM deamon. And both the Heimdal KCM
implementation and the SSSD KCM implementation of the KCM_OP_GEN_NEW
just generate a new unique ID for the subsidiary cache and return it.
There is no initialization involved in KCM_OP_GEN_NEW. The only time
KCM deamon initializes the cache is when it receives the
KCM_OP_INITIALIZE operation and looking at the MIT KCM ccache code,
the KCM_OP_INITIALIZE operation is only invoked through the
kcm_initialize() ccache method.

So what I'm not sure about is -- is it expected that gen_new doesn't
create the ccache "storage"? Why does it do that with dir and other
ccaches? Should the KCM deamon initialize the ccache with
KCM_OP_GEN_NEW?