When performing SASL authentication, the SASLAuthentication object uses XMPPConnection.getServiceName() to supply to the SASLMechanisim.authenticate(user,host,pass) method (line 192). When using GSSAPI, the fully qualified domain name (FQDN) of the server is required for authentication. For servers where the FQDN of the server does not match the domain, authentication will fail.
This is related in nature to
Simple fix: Change to connection.getHost().