1

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?

Improve this question

1 Answer 1

Reset to default
1
+50

There isn't really any other way to use it other than how it was designed because then you're not using SPNEGO, but some other protocol you've invented.

What I think you're asking is whether there are other mechanisms used out in the wild other than Kerberos and NTLM, and the answer to that is yes. A handful that I'm aware of are

  • Digest
  • NegoEx (an extension to the negotiate protocol that provides more knobs)
  • PKU2U (Kerberos derivative)

There are probably more, but these are the ones that are majorly used.

Improve this answer
3
  • Yes, my phrasing was probably confusing, I indeed meant "whether there are other mechanisms used out in the wild other than Kerberos and NTLM" as an underlying mechanism under SPNEGO. Thanks!
    – Eran Medan
    Commented Jul 17, 2019 at 22:25
  • So, if I understand correctly, SPNEGO is non Kerberos/NTLM specific, but the SPNEGO HTTP Negotiate protocol (tools.ietf.org/html/rfc4559) is?
    – Eran Medan
    Commented Jul 17, 2019 at 22:33
  • 1
    No, RFC 4559 just describes how Kerberos is wrapped in SPNEGO. That doesn't preclude any additional protocols used. It just just doesn't describe how other protocols are used. Something worth looking at is the extender protocol: datatracker.ietf.org/doc/draft-zhu-negoex
    – Steve
    Commented Jul 18, 2019 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .