From *testInvalidKerberosSpnegoWorkflow* in tests-ldap-kerberos dubugging results GSSContext provides negState response, but we dont use it if connection is already established (=no continuation is needed).

SPNEGO: missing negState field in the first reply ------------------------------------------------- Key: ELY-715 URL: https://issues.jboss.org/browse/ELY-715 Project: WildFly Elytron Issue Type: Bug Components: Authentication Mechanisms Reporter: Jan Kalina Assignee: Jan Kalina Fix For: 1.1.0.CR2 When the client sends an initial SPNEGO token with Kerberos as preferred mechanism and includes an invalid kerberos token, then client expects to see the {{WWW-Authenticate}} HTTP header with SPNEGO response {{negTokenResp[ negState = reject ]}}. As stated in [SPNEGO specification|https://tools.ietf.org/html/rfc4178#section-4.2.2] negstat is required in first reply: {code:borderStyle=dashed} negState ... This field is REQUIRED in the first reply from the target, and is OPTIONAL thereafter. When negState is absent, the actual state should be inferred from the state of the negotiated mechanism context. {code}