The GSSAPI SASL mechanism can be enabled by default. It won't be offered unless there is a specific gssapi-configuration option present.