s4 make use of gensec_gssapi_try_kerberos()