Is root supposed to be allowed to create arbitrary ccache without the need to setuid?
I'm asking because https://docs.pagure.org/sssd.sssd/design_pages/kcm.html seems to suggest that it is possible

KRB5CCNAME=KCM:foobar kinit
must not work unless done as root

However, when I try it I get the following

Name foobar is malformed [1432158296]: Credential cache name not allowed

And the code doesn't appear to make an exception for UID 0.