So the problem is i have no KRB5CCNAME in $_SERVER[] (php) for LDAP search:

I login to the server via kerberos gssapi, from Ubuntu to Windows Server 2012, using Samba
On my site (php) i authorize with kerberos, checked it (it works), and want to find user with ldap_sasl connection, but for this i should have the KRB5CCNAME variable in $_SERVER, but it’s not there

My .htaccess file include this lines of config:

AuthName "Kerberos"
AuthType Kerberos
KrbAuthRealms DOMAIN.RU
KrbServiceName HTTP
Krb5Keytab /etc/httpd_test.keytab #tested, originally is httpd.keytab
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbLocalUserMapping On
Require valid-user

KrbSaveCredentials On

KrbDelegateBasic On
KrbVerifyKDC Off

And i tried but it not works too with gssapi authentificate by this lines:

AuthType GSSAPI
AuthName "GSSAPI"
GssapiBasicAuth On
#GssapiUseS4U2Proxy On
GssapiCredStore keytab:/etc/httpd_test.keytab #tested, originally is httpd.keytab
#GssapiCredStore client_keytab:/etc/httpd_test.keytab
GssapiCredStore ccache:/var/run/apache2/krb5ccache
GssapiDelegCcacheDir /var/run/apache2/clientcaches
GssapiDelegCcacheUnique On
Require valid-user

It’s has the same trouble, and i don’t use it becouse much of guides says about KrbSaveCredentials On had to be requirement for create KRB5CCNAME

A few details:
0. Versions of packages:

Apache2 (2.4.52)
Linux Ubuntu 22.04.4
PHP 8.2
Kerberos5 (1.19.2)
SMBD (4.15.13-Ubuntu)

1. Rights for:

files:

-rw-r--r-- 1 root root httpd.keytab
-r--r----- 1 www-data www-data  httpd_test.keytab #tested
-rw-r--r-- 1 root root krb5.conf

directories:

drwxrwxrwt  8 root root tmp
drwxr-xr-x  2 root root krb5ccache
drwxr-xr-x  2 root root krb5deleg

2. Apache username is www-data.

3. Authentication working fine, I can get access to the site. Defined login name is correct.

From my krb5.conf:

[libdefaults]
        default_realm = DOMAIN.RU

        dns_lookup_realm = true
        dns_lookup_kdc = true
        forwardable = true

        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

And i checket ldap, it works fine
With $ldapconn = ldap_connect($ldaphost) and with login and password in code they find what i need, but i want to ldap_sasl_bind with gssapi
I suspect that I did not give the rights somewhere but idk
Where might be a problem?