I finally implemented an option to pam-krb5 to enable trace logging for debugging (pam-krb5 almost always uses a secure context, so the environment variable doesn't work), only to find that while krb5_set_trace_filename is prototyped in krb5.h, it isn't exported by the library. I assume this is an oversight?