Done in libkrb5 interface via krb5_context.  Some interfaces and
programs (kadmin, gssapi) may not be making the detailed error info
available though.