[29527] in Kerberos
Re: SPNEGO NTLM / Kerberos over HTTP (aka RFC4559) confusion
daemon@ATHENA.MIT.EDU (john@feith.com)
Wed Mar 19 01:15:20 2008
From: john@feith.com
Date: Tue, 18 Mar 2008 22:00:51 -0700 (PDT)
Message-ID: <52f87dba-4521-4775-9a90-1848fc63f049@f63g2000hsf.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Mar 18, 8:39 pm, "Michael B Allen" <iop...@gmail.com> wrote:
> That problem doesn't really have anything to do with SPNEGO. The SSPI
> layer knows nothing about interactive logons. The problem is that some
> application has acquired and inserted an NTLM credential into the
> credential cache so naturally the InitializeSecurityContext function
> as called by IE is going to pick that. That may not be optimal but it
> really has nothing to do with SPNEGO. The behavior you want would
> require that IE specify that it wants the SPNEGO mechanism and not the
> NTLM mechanism (not sure if SSPI supports the specification of a
> mechanism like GSSAPI does - it may simply infer the mechanism from
> the credential).
All I can tell you is Microsoft who recreated this problem in their
lab and who looked at their code indicated that IE * is * asking for
SPNEGO and special case code in the SSPI choose to return
a NTLM token because of an interactive logon session. I don't
have access to their source code so it hard for me to comment
on whether that is in fact how their code works.
I will note that the problem also occurs using Firefox when configured
to use the Microsoft SSPI and I have looked at that code which does
seem to explicitly request the Negotiate SSPI package.
-- John
john@feith.com
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
