When using gssproxy we need to enable syncing back ccaches. This allows the framework to receive back and store (in encrypted form) the ldap/ ticket acquire to talk to the directory server. Without this option each connection to the ldap server will cause a new rountrip to the KDC to acquire a new ldap/ ticket. This will increase the load on both the KDC and DS (to search the principal keys) as well as slow down each operation for the framework.