diff -up evolution-data-server-3.12.4/camel/camel-sasl-gssapi.c.gssapi-http-nego evolution-data-server-3.12.4/camel/camel-sasl-gssapi.c
--- evolution-data-server-3.12.4/camel/camel-sasl-gssapi.c.gssapi-http-nego	2014-03-24 02:07:52.000000000 -0700
+++ evolution-data-server-3.12.4/camel/camel-sasl-gssapi.c	2014-07-18 16:25:10.931975208 -0700
@@ -77,6 +77,13 @@ extern gss_OID gss_nt_service_name;
 	(G_TYPE_INSTANCE_GET_PRIVATE \
 	((obj), CAMEL_TYPE_SASL_GSSAPI, CamelSaslGssapiPrivate))
 
+static const char spnego_OID[] = "\x2b\x06\x01\x05\x05\x02";
+static const gss_OID_desc gss_mech_spnego = {
+       6,
+       &spnego_OID
+};
+
+
 #ifndef GSS_C_OID_KRBV5_DES
 #define GSS_C_OID_KRBV5_DES GSS_C_NO_OID
 #endif
@@ -114,6 +121,7 @@ struct _CamelSaslGssapiPrivate {
 	gss_name_t target;
 	gchar *override_host;
 	gchar *override_user;
+	gss_OID mech;
 };
 
 #endif /* HAVE_KRB5 */
@@ -182,6 +190,52 @@ gssapi_set_exception (OM_uint32 major,
 }
 
 static void
+gssapi_set_mechanism_exception (OM_uint32 minor,
+				gss_OID   mech,
+				GError    **error)
+{
+	char      *message = NULL;
+	OM_uint32 message_status = 0;
+	OM_uint32 tminor, tmajor;
+
+	if (mech == GSS_C_OID_KRBV5_DES) {
+		return gssapi_set_exception (GSS_S_FAILURE, minor, error);
+	}
+
+	do {
+		char            *message_part;
+		char            *new_message;
+		gss_buffer_desc status_string;
+		if ((tmajor = gss_display_status (&tminor, minor, 
+			GSS_C_MECH_CODE, mech, &message_status, 
+			&status_string)) != GSS_S_COMPLETE)
+		{
+			message_part = g_strdup_printf (
+				"Could not retrieve status code for %ud: "
+				"%ud %ud", minor, tmajor, tminor);
+			message_status = 0;
+		}
+		else
+		{
+			message_part = g_strdup (status_string.value);
+			gss_release_buffer (&tminor, &status_string);
+		}
+		new_message = g_strconcat (message, message_part, NULL);
+		g_free (message);
+		g_free (message_part);
+		message = new_message;
+	} while (message_status != 0);
+
+
+	g_set_error (
+		error, CAMEL_SERVICE_ERROR,
+		CAMEL_SERVICE_ERROR_CANT_AUTHENTICATE,
+		"%s", message);
+
+	g_free (message);
+}
+
+static void
 sasl_gssapi_finalize (GObject *object)
 {
 	CamelSaslGssapi *sasl = CAMEL_SASL_GSSAPI (object);
@@ -327,6 +381,10 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 		if (ai == NULL)
 			goto exit;
 
+		/* HTTP authentication should be SPNEGO not just KRB5 */
+		if (!strcmp (service_name, "HTTP"))
+			priv->mech = (gss_OID)&gss_mech_spnego;
+
 		str = g_strdup_printf ("%s@%s", service_name, ai->ai_canonname);
 		camel_freeaddrinfo (ai);
 
@@ -335,7 +393,10 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 		major = gss_import_name (&minor, &inbuf, GSS_C_NT_HOSTBASED_SERVICE, &priv->target);
 		g_free (str);
 
-		if (major != GSS_S_COMPLETE) {
+		if (major == GSS_S_FAILURE) {
+			gssapi_set_mechanism_exception (minor, priv->mech, error);
+		}
+		else if (major != GSS_S_COMPLETE) {
 			gssapi_set_exception (major, minor, error);
 			goto exit;
 		}
@@ -361,7 +422,7 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 		major = gss_init_sec_context (
 			&minor, GSS_C_NO_CREDENTIAL,
 			&priv->ctx, priv->target,
-			GSS_C_OID_KRBV5_DES,
+			priv->mech,
 			GSS_C_MUTUAL_FLAG |
 			GSS_C_REPLAY_FLAG |
 			GSS_C_SEQUENCE_FLAG,
@@ -382,7 +443,12 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 			    send_dbus_message (user))
 					goto challenge;
 
-			gssapi_set_exception (major, minor, error);
+			if (major == (OM_uint32) GSS_S_FAILURE) {
+				gssapi_set_mechanism_exception (minor,
+					priv->mech, error);
+			} else {
+				gssapi_set_exception (major, minor, error);
+			}
 			goto exit;
 		}
 
@@ -405,7 +471,10 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 		inbuf.length = token->len;
 
 		major = gss_unwrap (&minor, priv->ctx, &inbuf, &outbuf, &conf_state, &qop);
-		if (major != GSS_S_COMPLETE) {
+		if (major == GSS_S_FAILURE) {
+			gssapi_set_mechanism_exception (minor, priv->mech, error);
+			goto exit;
+		} else if (major != GSS_S_COMPLETE) {
 			gssapi_set_exception (major, minor, error);
 			goto exit;
 		}
@@ -444,7 +513,11 @@ sasl_gssapi_challenge_sync (CamelSasl *s
 #endif
 
 		major = gss_wrap (&minor, priv->ctx, FALSE, qop, &inbuf, &conf_state, &outbuf);
-		if (major != GSS_S_COMPLETE) {
+		if (major == GSS_S_FAILURE) {
+			gssapi_set_mechanism_exception (minor, priv->mech, error);
+			g_free (str);
+			goto exit;
+		} else if (major != GSS_S_COMPLETE) {
 			gssapi_set_exception (major, minor, error);
 			g_free (str);
 			goto exit;
@@ -503,6 +576,7 @@ camel_sasl_gssapi_init (CamelSaslGssapi
 	sasl->priv->target = GSS_C_NO_NAME;
 	sasl->priv->override_host = NULL;
 	sasl->priv->override_user = NULL;
+	sasl->priv->mech = GSS_C_OID_KRBV5_DES;
 #endif /* HAVE_KRB5 */
 }
 
