It would be more efficient to fetch the GSS credentials cache as the user, as we already switch identity to get its name.