Check cred_cache for a tgt that will still be valid after valid_for_at_least.

Try to initialize cred_cache with a tgt for principal if a valid one does not exist. Attempt to acquire a new TGT in the following ways:

• Move a valid TGT from the default cred cache (if different from cred_cache)
• Get a new TGT using keytab (if supplied)
• Renew an existing TGT in cred_cache

Create a new, empty credential cache and use keytab and principal to get and store a tgt into the cache.

Creating a new cred cache of types FILE or DIR leaks files on disk. The finalizer for Cred_cache.t closes the file and frees the memory associated with it, but the file doesn't get removed from disk.

Ensure an initial tgt. Upon success an ensure_tgt_valid job is scheduled to run every refresh_every. If one of these background jobs fails, the on_error of the first caller determines how to handle the error.