From version 10.11, the GSSAPI client plugin is statically linked into the server (https://mariadb.com/kb/en/authentication-plugin-gssapi/#installing-on-windows). The auth_gssapi_client.dll plugin is not produced by the default build.

In the case of master-slave replication, the slave server authenticates with the specified user on the master. Until version 10.11, this replication user could also authenticate with GSSAPI. From version 10.11 this does not work.

Based on debugging the server, I found the following:

find_plugin(const char *name /*="auth_gssapi_client"*/ , int type /*=2*/)

in source sql-common\client_plugin.c:124 can't find the plugin because the linked list plugin_list[type /*=2*/] only has "mysql_old_password" and "mysql_native_password". It can't find it, so it tries to load auth_gssapi_client.dll. Of course it doesn't exist. Therefore, an authentication error occurs.

The mysql_client_plugin_init() populates the list based on the mysql_client_builtins struct in source sql-common\client_plugin.c:292.
The mysql_client_builtins is statically defined in client.c. This should be expanded with the GSSAPI client.

The workaround is to force the build of the auth_gssapi_client.dll plugin.