Authentication issues with WWW-Authenticate: Negotiate

Question

I am trying to access a site that is password protected. It is not using basic authentication (even though the same user/pass box pops up in firefox) as the response header is WWW-Authenticate: Negotiate.

I want to automate the login process by sending the correct header.

In basic you would use something like:

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

What would I use for negotiate?

The WWW-Authenticate: Negotiate header means that the server can use NTLM or Kerberos (at least on OS prior to Windows 7 and Win 2008 Server when additional security support providers were added) for authentication and encryption. In this case of NTLM the negotiation requires multiple messages (challenge/responses) to be exchanged before the secured session is established, so there is no "correct header" to be sent from the start. You can find details regarding your problem msdn.microsoft.com/en-us/library/aa378748%28VS.85%29.aspx (SSP Packages Provided by Microsoft). — andrei m

Charith De Silva Charith De Silva · Accepted Answer · 2014-11-06T03:27:25

Putting this information here for future readers' benefit.

401 (Unauthorized) response header -> Request authentication header

Here are several WWW-Authenticate response headers. (The full list is at IANA: HTTP Authentication Schemes.)

WWW-Authenticate: Basic-> Authorization: Basic + token - Use for basic authentication
WWW-Authenticate: NTLM-> Authorization: NTLM + token (2 challenges)
WWW-Authenticate: Negotiate -> Authorization: Negotiate + token - used for Kerberos authentication
- By the way: IANA has this angry remark about Negotiate: This authentication scheme violates both HTTP semantics (being connection-oriented) and syntax (use of syntax incompatible with the WWW-Authenticate and Authorization header field syntax).

You can set the Authorization: Basic header only when you also have the WWW-Authenticate: Basic header on your 401 challenge.

But since you have WWW-Authenticate: Negotiate this should be the case for Kerberos based authentication.

Authentication issues with WWW-Authenticate: Negotiate

2 Answers