According to the kcm(8) man page:

"The tickets are renewed as long as is permitted by the KDC's policy."

This may be true on macOS, but it is plainly not so on Debian. In fact, from looking at the source git repository I get the impression that it hasn't been so for many years. The event loop is simply not there. It's amazing that no one seems to have reported this before.

To reproduce:
1. sudo apt install heimdal-kcm
2. in /etc/krb5.conf, set [libdefaults]default_ccache_name=KCM: (and/or default_cc_name=KCM: if using heimdal-clients; I tested with krb5-user)
3. kinit -l 6m -r 30m
4. klist -f; sleep 600; klist -f

Sergio Gelato <sergio.gelato@astro.su.se> writes:

Can you please send a bug to the upstream bug tracker? It is probably
better if you do it.

https://github.com/heimdal/heimdal/issues/

(unless you thnk this has alreaady been fixed upstream but I am somewhat
doubtful)