Bits of the GSSAPI that Cyrus Sasl uses aren't thread safe. There needs to be a way for a client application to share a lock with this library in order to prevent race conditions. It can be done using event callbacks through the C API but we can provide something more robust (RAII) in the C++ API.
Proposed client supplied lock, pretty much the C++17 lockable concept. Use a default if one isn't provided. This would be scoped at the process level since it's unlikely that multiple instances of libgssapi unless someone puts some effort in with dlopen/dlsym.