Projects/SPNEGO Hints - Revision history

Ghudson at 17:33, 16 February 2010

2010-02-16T17:33:36Z

TomYu at 04:25, 16 February 2010

2010-02-16T04:25:56Z

Ghudson: New page: {{project-completed}} This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work...

2010-02-13T18:13:30Z

New page: {{project-completed}} This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work...

New page

{{project-completed}}

This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work after the fact.

SPNEGO is a GSSAPI pseudo-mechanism, documented in [http://www.ietf.org/rfc/rfc4178.txt RFC 4178], which negotiates among other mechanisms (such as krb5) between a client and a server. The normal protocol sequence is for the initiator to send a list of supported mechanisms to the acceptor along with an optimistic token for the most preferred mechanism, then for the acceptor to choose a mechanism and continue or restart the context establishment process, and finally for message integrity codes to be exchanged (in some cases) to protect against downgrade attacks.

The Microsoft SPNEGO implementation supports an extension where the initiator can send a zero-length token to the acceptor to request a "negotiation hints" structure containing the server's name and list of supported mechanisms. Although this extension is not required by Microsoft products to our knowledge, some versions of Samba require it for SMB and LDAP.

The NegHints structure is documented in [http://msdn.microsoft.com/en-us/library/cc247039%28PROT.10%29.aspx MS-SPNG].

← Older revision		Revision as of 17:33, 16 February 2010
Line 1:		Line 1:
−	{{project-rel\|1.8}}	+	{{project-rel\|1.7}}

	This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work after the fact.		This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work after the fact.

← Older revision		Revision as of 04:25, 16 February 2010
Line 1:		Line 1:
−	{{project-~~completed~~}}	+	{{project-rel\|1.8}}

	This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work after the fact.		This project was implemented on the mskrb-integ branch in December 2008 and was merged onto the trunk in January 2009. This page serves to briefly describe the work after the fact.