RFC 2744 section 5.20 states "The caller must already have obtained a handle that refers to the context, although the context need not be fully established." But krb5_gss_inquire_context errors out with GSS_S_NO_CONTEXT/KG_CTX_INCOMPLETE if the context is not established. It shouldn't have this restriction.