It appears that two parallel external_auth tests can attempt to acquire a TGT at the same time. The last one will win, preventing normal operation of the first. To avoid this, both tests should set the KRB5CCNAME environment variable, and use unique Kerberos credential caches.