Use
auth optional pam_krb5.so minimum_uid=1000 try_first_pass retain_after_close session optional pam_krb5.so minimum_uid=1000 retain_after_close
retain_after_close will tell to PAM to no to clear the ticket after it completes. So it will stay.
Use
auth optional pam_krb5.so minimum_uid=1000 try_first_pass retain_after_close
session optional pam_krb5.so minimum_uid=1000 retain_after_close
retain_after_close will tell to PAM to no to clear the ticket after it completes. So it will stay.