SPNEGO
|
|
SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. SPNEGO is a standard GSSAPI pseudo-mechanism for peers to determine which GSSAPI mechanisms are shared, select one and then establish a security context with it. SPNEGO is sometimes pronounced or spelt "spengo".
SPNEGO's most visible use is in the "HTTP Negotiate" extension defined by Microsoft's expired internet draft draft-brezak-spnego-http-05.txt (http://www.ietf.org/internet-drafts/draft-brezak-spnego-http-05.txt). This authentication extension was first implemented in Internet Explorer 5.01 and IIS 5.0 and provided single sign-on capability later marketed as Windows Integrated Authentication. The negotiable sub-mechanisms included NTLM and Kerberos, both used in Active Directory.
The HTTP Negotiate extension was later implemented with similar support in Mozilla 1.7beta, Mozilla Firefox 0.9, and Konqueror 3.3.1.
History of the SPNEGO standard
- 01. 19 February, 1996 - Eric Baize and Denis Pinkas publish the internet draft Simple GSS-API Negotiation Mechanism (draft-ietf-cat-snego-01.txt).
- 02. 17 October, 1996 - The mechanism is assigned the object identifier 1.3.6.1.5.5.2 and is abbreviated snego.
- 03. 25 March, 1997 - Optomistic piggybacking of one mechanism's initial token is added. This saves a round trip.
- 04. 22 April, 1997 - The "preferred" mechanism concept is introduced. The draft standard's name is changed from just "Simple" to "Simple and Protected" (spnego).
- 05. 16 May, 1997 - Context flags are added (delegation, mutual auth, etc.). Defences are provided against attacks on the new "preferred" mechanism.
- 06. 22 July, 1997 - More context flags are added (integrity and confidentiality).
- 07. 18 November, 1998 - The rules of selecting the common mechanism are relaxed. Mechanism preference is integrated into the mechanism list.
- 08. 4 March, 1998 - An optimisation is made for an odd number of exchanges. The mechanism list itself is made optional.
- Final December 1998 - DER encoding is chosen to disambiguate how the MIC is calculated. The draft is submitted for standardisation as RFC 2478.
External links
- RFC 2478 The Simple and Protected GSS-API Negotiation Mechanism
- Microsoft technical article on SPNEGO tokens (http://msdn.microsoft.com/library/en-us/dnsecure/html/http-sso-2.asp)
- Vintela description of SPNEGO (http://www.vintela.com/technologies/spnego.php)
- SPNEGO support in Mozilla (http://www.mozilla.org/projects/netlib/integrated-auth.html)
- Apache module for supporting SPNEGO (http://rc.vintela.com/topics/apache/mod_auth_vas/)
References
- Template:Web reference
- Mozilla bug 17578: I want Kerberos authentication and TGT forwarding (https://bugzilla.mozilla.org/show_bug.cgi?id=17578)
- Template:Web reference
- Template:Web referenceTemplate:Compu-network-stub