The return value from `gssapi.AcceptContext.verify_mic` is actually the `qop_state` value returned from the underlying [`gss_verify_mic`](http://docs.oracle.com/cd/E19683-01/816-1331/overview-50/index.html) call, it indicates the cryptographic algorithm used in generating the MIC.

Checking that return value isn't the correct thing to do to check if the MIC verify succeeded or failed; this code needs to check if `verify_mic` raises `GSSException`, which indicates that the verification failed. Sorry if this wasn't clear in the python-gssapi docs.

In the next version of python-gssapi I'm working on at the moment, there'll be subclasses of GSSException for each error status defined in the GSSAPI, so you can do:

```python
try:
    gss_ctxt.verify_mic(message, mic)
except gssapi.BadSignature:
    # The MIC does not match, indicating the message may have been altered
```

... and catch the specific exception that it'll throw if the MIC verification fails. But for current versions, it'll just have to catch any `gssapi.GSSException`.