Missing 0x60 tag in SPNEGO Token sent from IE

Question

Hi,
I've used TagLib library (http://dev.taglab.com/sites/taglab-public/support/spnego.html) in my web application to support SSO with Windows domain.
The process was as follows:
1. The browser sent the request to my web application. The servlet filter (by TagLib) intercepted it, and sent it with Negotiation header and a 401 response code.
2. IE responded with a "Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw=="
3. The servlet filter tried to decode the spnego token, but was unsuccessful.
Token Hex Dump
0 : 0x4e 0x54 0x4c 0x4d 0x53 0x53 0x50 0x00 0x01 0x00 0x00 0x00 0x07 0x82 0x08 0xa2
16: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
31: 0x00 0x05 0x01 0x28 0x0a 0x00 0x00 0x00 0x0f
You obviously see that the first byte is not 0x60. It should be according to the rfc of spnego:
1. 0x60 -- Tag for [APPLICATION 0] SEQUENCE; indicates that
-- constructed form, definite length encoding follows.
(taken from http://tools.ietf.org/html/rfc2743)
Does anybody knows why??
Thanks,
Asaf Mesika

Answer 1

Recheck your IE Setting you have to change 2 things.
1. put the requesting site in IE to local-network
2. in the IE extended security option enable Integrated Windows Authentication
then you should see a client response something like YIll....... which is true.
To configure Intranet Authentication:
1. Click the Security tab, click Local intranet, and then click Custom Level.
2. In the Security Settings dialog box, scroll down to the User Authentication section of the list.
3. Select Automatic logon only in Intranet zone. This setting prevents users from having to re-enter logon credentials; a key piece to this solution.
4. Click OK to close the Security Settings dialog box.
In addition to the previous settings, one additional setting is required if you are running Internet Explorer 6.0.
1. In Internet Explorer, click Tools, and then click Internet Options.
2. Click the Advanced tab.
3. Scroll down to the Security section.
4. Make sure that Enable Integrated Windows Authentication (requires restart) is checked, and then click OK.
5. If this box was not checked, restart the browser.
write down here if you succeeded with the taglab libraries.. we would like to know it