curl's project page on


cURL > Mailing List > Monthly Index > Single Mail

curl-tracker Archives

[curl:bugs] #1302 HTTP Auth Negotiate sends Kerberos token instead of SPNEGO token

From: Daniel Stenberg <>
Date: Wed, 23 Jul 2014 10:09:33 +0000

- **status**: open --> closed-fixed
- **Comment**:

Recently fixed in git

** [bugs:#1302] HTTP Auth Negotiate sends Kerberos token instead of SPNEGO token**
**Status:** closed-fixed
**Created:** Wed Nov 13, 2013 12:07 PM UTC by Michael Osipov
**Last Updated:** Mon May 26, 2014 01:06 PM UTC
**Owner:** Daniel Stenberg
When a server challenges a client with 'WWW-Authenticate: Negotiate', it expects a SPNEGO token. Unfortunately, curl needs to be compiled with fbopenssl for this. If you compile with GSS-API only it generates a Kerberos 5 token in lib/curl_gssapi.c line 64, NO_OID. This makes the implemenation select a default mech (namely KRB 5).
For HTTP this can be easily patched with something like this:
My locally patched version works as desired. The function Curl_gss_init_sec_context is used in several spots, so if someone really needs Kerberos instead of SPNEGO another argument for passing the OID is necessary (FTP, SOCKS). With that change, fbopenssl is redundant and can be completely removed.
If not a wrapped SPNEGO token is send, an acceptor can react with:
GSSException: No credential found for: 1.2.840.113554.1.2.2 usage: Accept
I have reported the very same issue with Subversion and libserf:
The SSPI version does not suffer from this because "Negotiate" is passed to AcquireCredentialsHandle.
Sent from because is subscribed to
To unsubscribe from further messages, a project admin can change settings at  Or, if this is a mailing list, you can unsubscribe from the mailing list.
Received on 2014-07-23

These mail archives are generated by hypermail.

donate! Page updated March 21, 2014.
web site info

File upload with ASP.NET