The GSS-API is defined in a language independent way in RFC 2743. The Java language bindings are defined in RFC 2853
    An application starts out by instantiating a GSSManager
    which then serves as a factory for a security context. An application
    can use specific principal names and credentials that are also created
    using the GSSManager; or it can instantiate a
    context with system defaults. It then goes through a context
    establishment loop. Once a context is established with the
    peer, authentication is complete. Data protection such as integrity
    and confidentiality can then be obtained from this context.
The GSS-API does not perform any communication with the peer. It merely produces tokens that the application must somehow transport to the other end.
This model has the advantage that credential management is simple and predictable from the applications point of view. An application, given the right permissions, can purge the credentials in the Subject or renew them using standard Java API's. If it purged the credentials, it would be sure that the JGSS mechanism would fail, or if it renewed a time based credential it would be sure that a JGSS mechanism would succeed.
    This model does require that a {@link
    javax.security.auth.login JAAS login} be performed in order to
    authenticate and populate a Subject that the JGSS mechnanism can later 
    utilize. However, applications have the ability to relax this
    restiction by means of a system property:
    javax.security.auth.useSubjectCredsOnly. By default
    this system property will be assumed to be true (even when
    it is unset) indicating that providers must only use the credentials
    that are present in the current Subject. However, if this property is
    explicitly set to false by the application, then it indicates that
    the provider is free to use any credentials cache of its choice. Such
    a credential cache might be a disk cache, an in-memory cache, or even
    just the current Subject itself.
For an online tutorial on using Java GSS-API, please see Introduction to JAAS and Java GSS-API.
@since 1.4