SPNEGO

SPNEGO, short for Simple and Protected GSS-API Negotiation Mechanism, is a GSS-API mechanism designed to negotiate the choice of security mechanism between a client and a server. It allows two endpoints that implement GSS-API to agree on a common authentication method when multiple options are available, such as Kerberos v5 and NTLM. SPNEGO itself does not perform authentication; instead, it selects the underlying mechanism that will provide the authentication and protection services. The mechanism is defined in RFC 4178.

The negotiation works by exchanging SPNEGO tokens that carry a list of supported mechanisms and subsequent negotiation results. Typically, the client sends a NegTokenInit containing a list of mechanism OIDs it supports. The server replies with a NegTokenResp indicating the chosen mechanism and, if needed, a token to continue the authentication exchange. If no common mechanism is found, authentication fails or a fallback path may be invoked.

SPNEGO is widely used to implement the HTTP Negotiate authentication scheme, enabling Kerberos-based authentication over HTTP in environments such as Windows domains. In practice, clients (browsers) and servers negotiate whether to use Kerberos or NTLM, depending on support and configuration. The protocol aims to protect the negotiation process itself and to prevent downgrades, but the security properties ultimately depend on the underlying mechanism (for example, Kerberos) and the security of the transport channel.

See also: GSS-API, Kerberos, NTLM, HTTP Negotiate.