kerberised cifs must have root krb5cc_0 cache?

[steve <steve-dZ4O0aZtNmBWk0Htik3J/w@public.gmane.org>]

Ubuntu 12.10 clients in a Samba4 domain.

Hi
We are automounting cifs using:
-osec=krb5,multiuser.

It seems that unless the root cache:
/tmp/krb5cc_0
is present, users cannot enter the share even if they have a ticket with 
their own cache under /tmp

Is this the correct behavior?

If so, how to go about maintaining the cache alive. I thought about 
creating s domain user, say autofs-user and extracting his keytab. I 
would then run a script as root that calls k5start to maintain the 
ticket cache. But then, it could be overwritten if, say, Administrator 
logs in from a root account. Would that matter? So long as the root 
cache is present, does it matter which principal it has?

Cheers,
Steve