--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsReqBuilder.java	Wed Jul 10 09:43:34 2019 +0800
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsReqBuilder.java	Wed Jul 10 09:43:34 2019 +0800
@@ -367,6 +367,8 @@
                     paList = kerr.getPA();  // Update current paList
                 } else {
                     if (referralsState.handleError(ke)) {
+                        pakey = null;
+                        preAuthFailedOnce = false;
                         continue;
                     }
                     throw ke;