Home/ Questions/Q 9019129
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T04:42:09+00:00

I’m trying to implement SSO on an intranet application we are developing. I am

  • 0

I’m trying to implement SSO on an intranet application we are developing. I am using SPNEGO for this. Now I’m having some trouble configuring the SSO and hope someone here is able to help me.

The setup is like this:

  1. Linux server with tomcat to serve the intranet application
  2. Windows Server 2008 as domain controller (Active Directory)
  3. Windows 7 client with IE9 and Firefox

When I open the intranet application I see a GET request going from the client to the tomcat server. The first response of the tomcat server and the SpnegoFilter is a 401 unauthorized which is right, cause the client needs to be authenticated.

806 6.117724    192.168.65.50   192.168.65.50   HTTP    284 HTTP/1.1 401 Unauthorized 
WWW-Authenticate: Negotiate\r\n

The response of the client then is a GET request with a flag NTLMSSP_NEGOTIATE. Here it breaks. I don’t expect a NTLM response, but a kerberos/spnego response. Somehow I just can’t figure out how to send the correct response to the tomcat server.

808 6.123277    192.168.65.50   192.168.65.50   HTTP    637 GET / HTTP/1.1 , NTLMSSP_NEGOTIATE

By default NTLM isn’t supported by SPNEGO so I get the following entry in my log:

java.lang.UnsupportedOperationException: NTLM specified. Downgraded to Basic Auth (and/or SSL) but downgrade not supported.

So I’m doing something wrong, but aftert a day fiddling with configurations and policies I just can’t figure out what it is.

Hoping for some response.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Kerberos does not work on IPs, use fully qualified domain names.

    • 0