The proxy server was trying to use the principal name to perform a GSSAPI bind with the back-end server, but failed.
User response
Verify that the proxy server is correctly configured to accept Kerberos connections. Also verify that the proxy server's principal name is in the global administration group.