Ticket History #6973: error reporting made worse in gss_acquire_creds

Looking into this:

1. gss_acquire_cred tries all of the mechs in sequence and, if none of
them worked, returns the last major/minor status it saw. The last mech
is SPNEGO, which tries all of the other mechs and comes up with a minor
status of ERR_SPNEGO_NO_MECHS_AVAILABLE, which conveys no useful
information.

2. spnego_gss_acquire_cred has a bug where it stomps its own minor
status with a call to gss_release_oid_set(), so we don't even see the
useless error message; instead we get a minor code which maps to 0 and
gss_display_status returns the empty string.

I will fix #2 but not link it to this report, since it solves the
uninteresting part of the problem. #1 is harder; it's fundamentally
difficult to return a useful error message for "I tried a bunch of
things which I don't have a lot of specific knowledge about, and they
all failed." Returning the first major/minor code we see would probably
be more helpful for krb5 use cases, but not for Moonshot or similar use
cases.

Use first mech's status in gss_acquire_cred

If we can't acquire creds for any mech in gss_acquire_cred, return the
status of the first mech instead of the last mech, as it's more useful
in the typical case (where the first mech is krb5 and the last mech is
SPNEGO). This error reporting is not ideal when the user was
expecting to use some mech other than krb5, but it's about as good as
things were prior to #6894.

https://github.com/krb5/krb5/commit/71ca96850348569a7358b32301bb0cc60eb08103
Author: Greg Hudson <ghudson@mit.edu>
Commit: 71ca96850348569a7358b32301bb0cc60eb08103
Branch: master
src/lib/gssapi/mechglue/g_acquire_cred.c | 14 +++++++++++---
1 files changed, 11 insertions(+), 3 deletions(-)