Simple and Protected GSSAPI Negotiation Mechanism, often pronounced "spen-go", is a GSSAPI "pseudo
mechanism" used by client-server software to negotiate the choice of security technology.
SPNEGO is used when a client application wants to authenticate to a remote server, but neither
end is sure what authentication protocols the other supports.
The pseudo-mechanism uses a protocol to determine what common GSSAPI mechanisms are available,
selects one and then dispatches all further security operations to it.
This can help organizations deploy new security mechanisms in a phased manner.
SPNEGO's most visible use is in Microsoft's "HTTP Negotiate" authentication extension.
It was first implemented in Internet Explorer 5.01 and IIS 5.0 and provided single sign-on
capability later marketed as Integrated Windows Authentication.
The negotiable sub-mechanisms included NTLM and Kerberos, both used in Active Directory.
The HTTP Negotiate extension was later implemented with similar support in:
Mozilla 1.7 beta Mozilla Firefox 0.9
Konqueror 3.3.1 Google Chrome 6.0.472
History 19 February 1996 – Eric Baize and Denis
Pinkas publish the Internet Draft Simple GSS-API Negotiation Mechanism.
17 October 1996 – The mechanism is assigned the object identifier 1.3.6.1.5.5.2 and is
abbreviated snego. 25 March 1997 – Optimistic piggybacking
of one mechanism's initial token is added.
This saves a round trip.
22 April 1997 – The "preferred" mechanism concept is introduced.
The draft standard's name is changed from just "Simple" to "Simple and Protected".
16 May 1997 – Context flags are added.
Defenses are provided against attacks on the new "preferred" mechanism.
22 July 1997 – More context flags are added.
18 November 1998 – The rules of selecting the common mechanism are relaxed.
Mechanism preference is integrated into the mechanism list.
4 March 1998 – An optimisation is made for an odd number of exchanges.
The mechanism list itself is made optional.
Final December 1998 – DER encoding is chosen to disambiguate how the MIC is calculated.
The draft is submitted for standardisation as RFC 2478.
October 2005 – Interoperability with Microsoft implementations is addressed.
Some constraints are improved and clarified and defects corrected.
Published as RFC 4178, although it is now non-interoperable with strict implementations
of now-obsoleted RFC 2478.
Notes
References "Internet Drafts of RFC 4178".
All Internet Drafts Collection – Drafts.
Retrieved 23 August 2014.
"HTTP-Based Cross-Platform Authentication via the Negotiate Protocol".
Microsoft Developer Network library.
Retrieved 28 May 2005.
"using mod_auth_kerb and Windows 2000/2003 as KDC".
Tutorial.
Retrieved 2 December 2005.
External links RFC 4178 The Simple and Protected GSS-API
Negotiation Mechanism.
RFC 4559 SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows
Microsoft technical article on SPNEGO tokens SPNEGO support in Mozilla
mod_auth_kerb Apache module supporting SPNEGO via Kerberos
mod_auth_sspi Apache module supporting SPNEGO via SSPI
Earlier drafts of draft-brezak-spnego-http-05.txt, since −05 is no longer available.
[http:msdn.microsoft.comdefault.asp?url=en-ushtml/MSDN_PAC.asp Microsoft article on authorization data present
in Kerberos tickets] [http:appliedcrypto.com/spnegoarticles.do
SPNEGO and SSO articles] COMMERCIAL SPNEGO for Tomcat, JBoss, WebSphere...
[http:www.matrix.org.cncas Security Site for Windows Integration Authentication with SSO]
Support for SPNEGO in Java GSS with Java 6.
COMMERCIAL Plexcel – PHP Active Directory Integration
WebSphere with a side of SPNEGO [http:s2.diffuse.itshow/6602-SPNEGO_authentication_and_credential_delegation_with_Java
SPNEGO and credential delegation with Java] [http:www-03.ibm.comtechdocsWebIndex/WP101215
Making use of SPNEGO in your J2EE and .NET Client Applications]
SPNEGO Http Servlet Filter – Free Open Source Library
Waffle: native Java Tomcat authentication on Windows
Tomcat authentication on Windows via SPNEGO using JNI