GSS-API exceptions contain two different error code -- major error codes that make sense irrespective of what mechanism is being used, and minor error codes that contain mechanism specific values.

The major error codes and the methods that can cause them to be included in a GSSException are well defined. However, there is not standard definition for the minor error codes that the Kerberos V5 GSS-API mechanism should use. At present, all minor code value (with the exception of one thrown for export control reasons) is -1.

As it is right now, this value is completely useless because it it not communicating any additional information about the problem at the mechanism level. (The major error code will provide some high-level information but that might not be sufficient to determine the problem.)

The Java GSSKrb5 implementation should define minor error code values.