How does the digest mode in NTLM mech for GSSAPI work exactly?

I am trying to use the server side heimdal gssapi.
I am trying to specifically to get it working with NTLM.
So when I call the gss_accept_sec_context function, the following errors
are reported back by gss_display_status:

The gss major code info is :Unspecified GSS failure.  Minor code may
provide more information
The gss minor code info is :An invalid status code was supplied
The gss minor code info is :An invalid status code was supplied
The gss minor code info is :The token was a duplicate of an earlier token
The gss minor code info is :The token's validity period has expired
The gss minor code info is :An invalid status code was supplied
The gss minor code info is :An invalid status code was supplied
The gss minor code info is :An invalid status code was supplied
The gss minor code info is :An invalid status code was supplied


So I traced the code till:

_gss_ntlm_accept_sec_context -> _gss_ntlm_allocate_ctx -> kdc_alloc.

When I print the value of the krb5_context structure the error string
contained is:

Client (host/[email protected]) unknown

but the key table does contain this exact client name.

How do I debug farther and any other suggestions?
-- 
*Sushant Mathur*