gssapi_krb5_set_error_string() stores the last Kerberos error in thread- specific data. When gssapi_krb5_get_error_string() is called, the caller then owns the error string. -- Luke --