SASL GSSAPI authentication failed for on $external from client

Ops and Admin
1

Hi,
I am receiving the above error in the DB logs.

It is as seen above including the missing name so:

“SASL GSSAPI authentication failed for on $external from client [IP Address omitted] ProtocolError: SASL(-1): generic failure: SSPI: AcceptSecurityContext: The token supplied to the function is invalid\r\n\r”,

The IP address is of a box which has about 60 services on it and probably other unregistered apps that can hit mongo

I have just upgraded from Mongo 3.6 to Mongo 4.0.23 and this error started to appear. From various other analytics I know that the majority of clients can connect to the replica set. I need help to pin down which process is causing the error,

What can I do to narrow this down?

2

Here are the connections from the log:
This replica set is hosted via Windows using Windows Services
Windows Server 2012 R2 Standard

    "2021-04-29T15:31:45.527+0100 I COMMAND  [conn14814] command admin.$cmd command: buildInfo { buildinfo: true, $readPreference: { mode: \"secondaryPreferred\" }, $db: \"admin\" } numYields:0 reslen:1300 locks:{} protocol:op_query 11ms\r", 

    "2021-04-29T15:31:45.529+0100 D COMMAND  [conn14814] run command $external.$cmd { saslStart: 1, mechanism: \"GSSAPI\", payload: \"xxx\", $readPreference: { mode: \"secondaryPreferred\" }, $db: \"$external\" }\r", 

    "2021-04-29T15:31:45.529+0100 D ACCESS   [conn14814] SSPI principal name: [REDACTED]", 

    "2021-04-29T15:31:45.531+0100 E ACCESS   [conn14814] SSPI: AcceptSecurityContext: The token supplied to the function is invalid\\r\\n\r", 

    "2021-04-29T15:31:45.534+0100 D ACCESS   [conn14814] Was not able to acquire authorization username from Cyrus SASL. Falling back to authentication name.\r", 

    "2021-04-29T15:31:45.535+0100 E ACCESS   [conn14814] Was not able to acquire principal id from Cyrus SASL: -6\r", 

    "2021-04-29T15:31:45.537+0100 I ACCESS   [conn14814] SASL GSSAPI authentication failed for  on $external from client [IP ADDRESS] ; ProtocolError: SASL(-1): generic failure: SSPI: AcceptSecurityContext: The token supplied to the function is invalid\\r\\n\r", 
  
    "2021-04-29T15:31:45.539+0100 D ACCESS   [conn14814] Was not able to acquire authorization username from Cyrus SASL. Falling back to authentication name.\r", 

    "2021-04-29T15:31:45.541+0100 E ACCESS   [conn14814] Was not able to acquire principal id from Cyrus SASL: -6\r", 

    "2021-04-29T15:31:45.544+0100 D -        [conn14814] User Assertion: AuthenticationFailed: Authentication failed. src\\mongo\\db\\auth\\sasl_commands.cpp 300\r", 

    "2021-04-29T15:31:45.579+0100 D COMMAND  [conn14814] assertion while executing command 'saslStart' on database '$external' with arguments '{ saslStart: 1, mechanism: \"GSSAPI\", payload: \"xxx\", $readPreference: { mode: \"secondaryPreferred\" }, $db: \"$external\" }': AuthenticationFailed: Authentication failed.\r", 

    "2021-04-29T15:31:45.579+0100 I COMMAND  [conn14814] command $external.$cmd command: saslStart { saslStart: 1, mechanism: \"GSSAPI\", payload: \"xxx\", $readPreference: { mode: \"secondaryPreferred\" }, $db: \"$external\" } numYields:0 ok:0 errMsg:\"Authentication failed.\" errName:AuthenticationFailed errCode:18 reslen:258 locks:{} protocol:op_query 50ms\r", 

    "2021-04-29T15:31:45.581+0100 D NETWORK  [conn14814] Session from [IP ADDRESS] encountered a network error during SourceMessage: HostUnreachable: Connection closed by peer\r", 

    "2021-04-29T15:31:45.581+0100 I NETWORK  [conn14814] end connection [IP ADDRESS] (554 connections now open)\r", 
  
    "2021-04-29T15:31:45.582+0100 D NETWORK  [conn14814] Cancelling outstanding I/O operations on connection to [IP ADDRESS]\r",