||The lead section of this article may need to be rewritten. (December 2010)|
Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), often pronounced "spen-go", is a GSSAPI "pseudo mechanism" that is used to negotiate one of a number of possible real mechanisms. SPNEGO is used when a client application wants to authenticate to a remote server, but neither end is sure what authentication protocols the other supports. The pseudo-mechanism uses a protocol to determine what common GSSAPI mechanisms are available, selects one and then dispatches all further security operations to it. This can help organizations deploy new security mechanisms in a phased manner.
SPNEGO's most visible use is in Microsoft's "HTTP Negotiate" authentication extension. It was first implemented in Internet Explorer 5.01 and IIS 5.0 and provided single sign-on capability later marketed as Integrated Windows Authentication. The negotiable sub-mechanisms included NTLM and Kerberos, both used in Active Directory. The HTTP Negotiate extension was later implemented with similar support in:
- 19 February 1996 – Eric Baize and Denis Pinkas publish the Internet Draft Simple GSS-API Negotiation Mechanism (draft-ietf-cat-snego-01.txt).
- 17 October 1996 – The mechanism is assigned the object identifier 184.108.40.206.5.5.2 and is abbreviated snego.
- 25 March 1997 – Optimistic piggybacking of one mechanism's initial token is added. This saves a round trip.
- 22 April 1997 – The "preferred" mechanism concept is introduced. The draft standard's name is changed from just "Simple" to "Simple and Protected" (spnego).
- 16 May 1997 – Context flags are added (delegation, mutual auth, etc.). Defenses are provided against attacks on the new "preferred" mechanism.
- 22 July 1997 – More context flags are added (integrity and confidentiality).
- 18 November 1998 – The rules of selecting the common mechanism are relaxed. Mechanism preference is integrated into the mechanism list.
- 4 March 1998 – An optimisation is made for an odd number of exchanges. The mechanism list itself is made optional.
- Final December 1998 – DER encoding is chosen to disambiguate how the MIC is calculated. The draft is submitted for standardisation as RFC 2478.
- October 2005 – Interoperability with Microsoft implementations is addressed. Some constraints are improved and clarified and defects corrected. Published as RFC 4178, although it is now non-interoperable with strict implementations of now-obsoleted RFC 2478.
- Mozilla bug 17578: I want Kerberos authentication and TGT forwarding
- "Konqueror has SPNEGO support". Apache and Kerberos tutorial. Retrieved 30 May 2005.
- "Support for SPNEGO authentication". Google Chrome Enhancement Request. Retrieved 20 November 2010.
- "Internet Drafts of RFC 2478". All (Current & Expired) Internet Drafts Collection – Drafts. Retrieved 28 May 2005.
- "HTTP-Based Cross-Platform Authentication via the Negotiate Protocol". Microsoft Developer Network (MSDN) library. Retrieved 28 May 2005.
- "using mod_auth_kerb and Windows 2000/2003 as KDC". Tutorial. Retrieved 2 December 2005.
- RFC 4178 The Simple and Protected GSS-API Negotiation Mechanism (obsoletes RFC 2478).
- RFC 4559 SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows
- Microsoft technical article on SPNEGO tokens
- SPNEGO support in Mozilla
- mod_auth_kerb Apache module supporting SPNEGO via Kerberos
- mod_auth_sspi Apache module supporting SPNEGO via SSPI
- Earlier drafts of draft-brezak-spnego-http-05.txt, since −05 is no longer available.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnkerb/html/MSDN_PAC.aspMicrosoft article on authorization data present in Kerberos tickets (PAC)]
http://appliedcrypto.com/spnegoarticles.doSPNEGO and SSO articles]
- COMMERCIAL SPNEGO for Tomcat, JBoss, WebSphere...
http://www.matrix.org.cn/blog/casSecurity Site for Windows Integration Authentication with SSO]
- Support for SPNEGO in Java GSS with Java 6.
- COMMERCIAL Plexcel – PHP Active Directory Integration
- WebSphere with a side of SPNEGO
- SPNEGO and credential delegation with Java
http://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101215Making use of SPNEGO in your J2EE and .NET Client Applications]
- SPNEGO Http Servlet Filter – Free Open Source Library
- Waffle: native Java Tomcat authentication on Windows (NTLM or Kerberos)
- Tomcat authentication on Windows via SPNEGO (NTLM or Kerberos) using JNI