Error message "Negotiate Header was invalid"

hello,

we are seeing occasionally below error in a number of applications using spring security

Error:

Negotiate Header was invalid: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
2016-04-07T09:45:38.000+00:00 [App/0] OUT org.springframework.security.authentication.BadCredentialsException: Kerberos validation not successful
2016-04-07T09:45:38.000+00:00 [App/0] OUT at com.fil.dc.authentication.provider.KerberosServiceAuthenticationProvider.authenticate(KerberosServiceAuthenticationProvider.java:44) ~[dc-Authentication-Api-1.0.0.jar:na] 

Caused by: org.ietf.jgss.GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
2016-04-07T09:45:35.000+00:00 [App/0] OUT at sun.security.jgss.GSSHeader.<init>(GSSHeader.java:97) ~[na:1.8.0_71-]
2016-04-07T09:45:35.000+00:00 [App/0] OUT at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:306) ~[na:1.8.0_71-]
2016-04-07T09:45:35.000+00:00 [App/0] OUT at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:170) ~[spring-security-kerberos-core-1.0.1.RELEASE.jar:1.0.1.RELEASE] 


http://forum.spring.io/forum/spring-projects/security/121613-spring-security-spnego-kerberos-sso

Since the application is deployed in cloud foundry and the error is occasional we have ruled out some of the suggestions on web
i.e.

1. application and ARS deployed on same server
2. network connectivity issues - since we have not seen any firewall drops.

I found this archived link of spring forums with no conclusive solution before the forums were closed.
http://forum.spring.io/forum/spring-projects/security/121613-spring-security-spnego-kerberos-sso.

Please can you advise if an issue was found with a solution or guide towards a direction because it seems instead of SPNEGO, NTLM is being used.

Start with KerberosServiceAuthenticationProvider.authenticate and SunJaasKerberosTicketValidator.SunJaasKerberosTicketValidator, then trace the reported GSSHeader failure and the Negotiate header handling. Reproduce the intermittent case if possible, determine why an NTLM token reaches Kerberos validation, and document a confirmed cause and resolution.