docs: def get_gssapi_token(principal, host, domain):
      '''
      Get the gssapi token for Kerberos connection
  
      principal
         The service principal
      host
         Host url where we would like to authenticate
      domain
         Kerberos user domain
      '''
  
      if not HAS_GSSAPI:
          raise ImportError('The gssapi library is not imported.')
  
      service = '{0}/{1}@{2}'.format(principal, host, domain)
      log.debug('Retrieving gsspi token for service %s', service)
      service_name = gssapi.Name(service, gssapi.C_NT_USER_NAME)
      ctx = gssapi.InitContext(service_name)
      in_token = None
      while not ctx.established:
          out_token = ctx.step(in_token)
          if out_token:
              if six.PY2:
                  return base64.b64encode(out_token)
              return base64.b64encode(salt.utils.stringutils.to_bytes(out_token))
          if ctx.established:
              break
          if not in_token:
              raise salt.exceptions.CommandExecutionError(
                  'Can\'t receive token, no response from server')
      raise salt.exceptions.CommandExecutionError(
          'Context established, but didn\'t receive token')