SPNEGO
termsecurityweb dev
Simple and Protected GSS-API Negotiation Mechanism: the wrapper that carries a Kerberos service ticket inside HTTP's Negotiate authentication scheme, letting a browser authenticate to a website silently from the user's existing domain session.
The server challenges with WWW-Authenticate: Negotiate; a browser configured to trust the site answers with a ticket - the machinery marketed as Integrated Windows Authentication.
SPNEGO is the negotiation wrapper that lets a client and server agree on which authentication mechanism to use, and in practice that means choosing Kerberos when it is available and falling back to NTLM when it is not. It is what makes seamless Windows single sign-on to a web application work without the user seeing a prompt.
The browser flow is worth knowing because it explains the failures. The server responds with a Negotiate challenge, and a browser configured to trust that site fetches a Kerberos ticket for the service and presents it. If any part of that fails, and the classic causes are a missing or duplicated service principal name, access by IP address rather than hostname, or clock skew, the client silently falls back to NTLM and the user gets a password prompt they were not supposed to see.
That silent fallback is the diagnostic key. A password prompt in an environment where single sign-on is meant to be automatic is almost never a password problem: it is a Kerberos problem wearing a login box. Checking the service principal name first, and the clock second, resolves the large majority of cases.
Also known as: Negotiate, Integrated Windows Authentication, IWA