CODEWITHSUNDEEP
authenticationheaderhttp-headershttp-authentication
fire
fire

Reputation: 21531

Authentication issues with WWW-Authenticate: Negotiate

I am trying to access a site that is password protected. It is not using basic authentication (even though the same user/pass box pops up in firefox) as the response header is WWW-Authenticate: Negotiate.

I want to automate the login process by sending the correct header.

In basic you would use something like:

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

What would I use for negotiate?

Upvotes: 44

Views: 148538

Answers (2)

Charith De Silva
Charith De Silva

Reputation: 3720

Putting this information here for future readers' benefit.

  • WWW-Authenticate: Basic-> Authorization: Basic + token - Use for basic authentication
  • WWW-Authenticate: NTLM-> Authorization: NTLM + token (2 challenges)
  • WWW-Authenticate: Negotiate -> Authorization: Negotiate + token - used for Kerberos authentication
    • By the way: IANA has this angry remark about Negotiate: This authentication scheme violates both HTTP semantics (being connection-oriented) and syntax (use of syntax incompatible with the WWW-Authenticate and Authorization header field syntax).

You can set the Authorization: Basic header only when you also have the WWW-Authenticate: Basic header on your 401 challenge.

But since you have WWW-Authenticate: Negotiate this should be the case for Kerberos based authentication.

Upvotes: 61

zcopley
zcopley

Reputation: 592

The web server is prompting you for a SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) token.

This is a Microsoft invention for negotiating a type of authentication to use for Web SSO (single-sign-on):

  • either NTLM
  • or Kerberos.

See:

Upvotes: 40

Related Questions