Description:
------------
I have been configuring the Roundcube webmail system to authenticate using Kerberos, and I found myself doing some experiments to figure out a misconfiguration. The error reporting from php-pecl-krb5 was missing some key information that would have made this task easier.

I found the following in my logs:

May 26 13:37:18 herald roundcube: PHP Warning:  GSSAPIContext::initSecContext(): Unspecified GSS failure.  Minor code may provide more information (851968,2529639066) in /.../mail/program/lib/Roundcube/rcube_imap_generic.php on line 644

It seems the function which implements initSecContext() in gssapi.c does not print the error which returns from gss_init_sec_context(). Instead, it looks like the library prints no error until after the calls to gss_release_name() and gss_release_buffer(); this results in the ambiguous error above. Adding an error printing call immediately after gss_init_sec_context() allowed me to realize that the actual error was:

... Cannot find KDC for realm ...

This message made it much easier to realize that /etc/krb5.conf contained an error.