The GSS-krb5 mechanism passes tokens from the Kerberos protocol encapsulated in GSS style messages. When the mechanism receives a GSS style token it looks at the tkekn type to determine which Kerberos protocol message it contains. Currently, the token type for the KRB-ERROR message is not supported and receiving it will cause an exception saying that the token was improper.

The KRB-ERROR message is mostly utilized as part of context establishment in GSSKrb5 to indicate a failure. One scenario when the server sends this to the client is when the client sends the context establishment token to the wrong server identity.