Please help. Negotiate field in http header - Kerberos, SPNEGO, Base64... ?

Question

Hello to you all.
I'm trying to implement a Kerberized SSO solution in Win2000
environment. The web servers are apaches, the clients are IE5.5+
But I had encountered the following problem:
I wrote a servlet in java on the web server that sends 401 http error
+ "Negotiate" in the www-authenticate field. Then the client sends me
back in the same field "Negotiate " and a long string that ends with
'==' and it's somehow encoded...
That's the problematic point. I saw it's encoded in base64, but
decoding it didn't brought me to anything. Furthermore, I read that
it's a spnego protocol. What am I doing with that? Does JDK1.4 gives
enough to work with that?
All I know that in that string is the TGS sent to me... and that's all
I need to authenticate my client, don't I?!
Do you know what should I do with that string? Can you tell me what am
I missing? Should I decode it with the '==' or without? What does it
mean anyway?
I'd really appriciate if you help me.
Thanks very much in advance,
Danik.

Answer 1

Close... SPNEGO is a GSSAPI mechanism for negotiating another mechanism. JDK 1.4 comes with a Kerberos mechanism provider out of the box, but not SPNEGO. Even though Microsoft's "Negotiate" auth method ends up negotiating Kerberos, you need to have a SPNEGO provider installed to effectively tell it to use Kerberos.
The '==' is Base64 padding (the Base64-encoded string will end in '=' or '==' if the input content length is not divisible by 3). You would include it when decoding. The byte array you get from decoding is fed to the acceptSecContext method in org.ietf.jgss.GSSContext -- but you will get an "unknown mechanism" error if you don't have a SPNEGO mechanism provider.
If you don't have the inclination to write a provider yourself (I know I wouldn't), and you have some cash to spend (I know I don't), you can get a SPNEGO provider from:
http://www.wedgetail.com/jcsi/sso/FAQ.html
They actually provide a complete solution for doing exactly what you are attempting.
If you are just looking to provide single sign-on to a web application for Windows clients, and you don't necessarily need to do it via Kerberos, jCIFS provides a solution for performing NTLM authentication (the precursor to Negotiate, which authenticates against NT/Samba domains). You can get jCIFS from
http://jcifs.samba.org
The site is temporarily transitioning to a new ISP, so the latest version (0.7.5) can actually be found at:
http://users.erols.com/mballen/jcifs
The client side of NTLM is also supported in JDK 1.4.2, which would allow single sign-on for applets or Java applications.