Description of problem:
When I log in using gdm and gnome-shell and then lock the screen, on unlock gdm is calling pam_setcred with the wrong flag (it uses PAM_ESTABLISH_CRED instead of PAM_REINITIALIZE_CRED).  If a module in the PAM configuration is going to do different things based on that flag, the wrong thing can happen.

Version-Release number of selected component (if applicable):
gdm-3.8.4-7.el7.x86_64
gnome-shell-3.8.4-14.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Use authconfig to enable NIS and Kerberos, which should force the system to use pam_krb5.
2. Add this to your /etc/krb5.conf's [appdefaults] section:
  pam = {
    debug = true
  }
3. Log in, lock the screen, and unlock it.

Actual results:
/var/log/secure will note something like: 
Nov 19 10:38:56 blah gdm-password]: pam_krb5[2258]: pam_setcred(PAM_ESTABLISH_CRED) returning 0 (Success)

Expected results:
/var/log/secure will note something like: 
Nov 19 10:38:56 blah gdm-password]: pam_krb5[2258]: pam_setcred(PAM_REINITIALIZE_CRED) returning 0 (Success)

Additional info:
While this appears to work when the default ccache is configured to a location that doesn't change (so that when the module attempts to create a new ccache, it happens to use the same location that was also used when the user logged in), if you configure it to use a per-session location (say, FILE:/tmp/krb5cc_%{uid}_XXXXXX), it'll create a new ccache every time the user unlocks their screen, and the ccache that the user is actually using won't be updated.