Hi,
Currently the SPENEGO sasl2 library is missing in the 5.12 flatpak installation so it can't work, but even if the mechanism was available, I'm really not sure how a container should interact with kerberos tickets.
I'm assuming the host should be managing the ticket, and perhaps there should be a way of allowing or disallowing access to the ticket for individual applications. (This seems similar to the questions about access to GPG keys I asked about in #12 )