k5start is a modified version of kinit that can use keytabs to authenticate, can run as a daemon and wake up periodically to refresh a ticket, and can run single commands with their own authentication credentials and refresh those credentials until the command exits. We it here at Stanford to maintain Kerberos tickets for services that need to authenticate to Kerberos so that the services don't have to include all that logic themselves.
k5start can optionally run a program after each time that the ticket has been refreshed. We use this to run aklog or afslog to maintain an AFS token for services that need to authenticate to AFS. Both programs can also run a specific command with authentication, renewing the credentials until the command completes. There is also support for AFS PAGs, putting the command in its own PAG so that its credentials don't interfere with any other processes on the system.
Author: Russ Allbery http://www.eyrie.org/~eagle/software/kstart/