Assume the krb5 mechanism if no mechanism was provided.  ipsec-tools
expects this behavior.  Patch from Daniel Kahn Gillmor.

Kerberos RT #3467
Debian bug #351877

=== krb5/src/lib/gssapi/krb5/canon_name.c
==================================================================
--- krb5/src/lib/gssapi/krb5/canon_name.c	(revision 2103)
+++ krb5/src/lib/gssapi/krb5/canon_name.c	(local)
@@ -34,7 +34,8 @@
 				     const gss_OID mech_type,
 				     gss_name_t *output_name)
 {
-    if (!g_OID_equal(gss_mech_krb5, mech_type) &&
+    if ((GSS_C_NO_OID != mech_type) &&
+	!g_OID_equal(gss_mech_krb5, mech_type) &&
 	!g_OID_equal(gss_mech_krb5_old, mech_type)) {
 	*minor_status = 0;
 	return(GSS_S_BAD_MECH);
