GSSAPI is something your Kerberos library should support. at least MIT's does.

$ ls /usr/lsd/kerberos/5-1.2.7/lib/libgss*
/usr/lsd/kerberos/5-1.2.7/lib/libgssapi_krb5.a
/usr/lsd/kerberos/5-1.2.7/lib/libgssapi_krb5.so
/usr/lsd/kerberos/5-1.2.7/lib/libgssapi_krb5.so.2
/usr/lsd/kerberos/5-1.2.7/lib/libgssapi_krb5.so.2.2
/usr/lsd/kerberos/5-1.2.7/lib/libgssrpc.a
/usr/lsd/kerberos/5-1.2.7/lib/libgssrpc.so
/usr/lsd/kerberos/5-1.2.7/lib/libgssrpc.so.3
/usr/lsd/kerberos/5-1.2.7/lib/libgssrpc.so.3.0

$ ls /usr/lsd/kerberos/5-1.2.7/include/gssapi
gssapi.h                gssapi_generic.h        gssapi_krb5.h
[download]

after that i'm not sure about modules for administration. if all else fails you can look at C source for kpasswd and wrap up the needed funcionality with the help of Inline::C