if (!auth.pkcert) {
        krb5_get_init_creds_opt_set_pa_password(context, opt,
                                                auth.password->bv_val,
                                                NULL);
    } else {
        krb5_get_init_creds_opt_set_pkinit(context, opt, target,
                                           auth.pkcert, NULL, NULL, NULL,
                                           0, 0, NULL,
                                           auth.password->bv_val);
    }