Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
There is no explicit "use Kerberos" option in the settings for an account. If a server lists GSSAPI as one of its supported mechanisms, the logged-in user has valid Kerberos credentials in their cache, and the appropriate SASL GSSAPI libraries are installed on the client machine, then it will use Kerberos for authentication.
The installation of the SASL GSSAPI libraries was what initially tripped me up. At the time of writing, the documentation does not appear to mention this. Since Pidgin does not know that you want Kerberos authentication for an account, no error is generated if they are not installed; it simply tries to use one of the other authentication mechanisms available.
On Debian and its derivatives (e.g., Ubuntu), this can be resolved by installing the