We have setup a bitbucket server (Bitbucket 6.6.1 Data Center edition) with Kerberos authentication using the Kantega v3.6.5 bitbucket plugin, and can clone successfully using git from the commandline. As the same user with the same Kerberos tickets, libgit2 compiled with -DUSE_GSSAPI=ON fails to clone the same repository with the error "could not restart authentication".

The error is coming from src/transports/auth_negotiate.c:

	} else if (ctx->gss_context != GSS_C_NO_CONTEXT) {
		git_error_set(GIT_ERROR_NET, "could not restart authentication");
		error = -1;
		goto done;
	}

Using gdb I've confirmed that for some reason on the second time through this function, gss_context is no longer a null pointer even though gss_init_sec_context returned a request for auth to continue.

I was able to fix the issue by modifying this else if block to be similar to what is shown in the GNU Generic Security Service (GSS) API Reference Manual, on page 14:

	} else if (ctx->gss_context != GSS_C_NO_CONTEXT) {
                  gss_delete_sec_context(&status_minor, &ctx->gss_context, GSS_C_NO_BUFFER);
                  ctx->gss_context = GSS_C_NO_CONTEXT;
	}

Tested using libgit2.0.25.1 on RHEL 7, with the above bitbucket server setup. The behaviour looks to be the same in the newest source.