One more unrelated question.  I'm trying to think of the best way to
do the interface, particularly how to access error messages and what
to return to the caller.  For most functions the caller just needs to
know if the function returned true, or if there was an error a way to
get the error message.  So, I could for example return 0 on success or
the error message number on failure.  Or I could return true/false,
store any error message number in a C global variable, and then have a
function which returns the text error message if the original function
returned false.

The latter seems more intuitive.  For example

krb = Krb5.new
if krb.authenticate_with_password(user,pass)
  # authenticated
else
  p krb.errstr
end

As opposed to:

res = krb.authenticate(user,pass)
if res == 0
  # authenticated
else
  p krb.errstr(res)
end

And in the case where a method returns a handle that will be used
later, I'm thinking return the handle on success, and on failure
return nil and make the error available via krb.errstr?

Chris