Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

domain AD on windows 2008 R2, linux server alfresco 3.4c, windows-7 client. I'm trying to get automatically logged into alfresco from the windows-7 client.

I've looked with wireshark to see what happens:
1. Client goes to /alfresco
2. Server sends Redirect to page
3. Client goes to Redirected page
4. Server sends a WWW-Authenticate: Negotiate header
5. Client DOES NOT respond to this

how can i configure the windows-7 client (or the AD domain) so that the client will in fact engage with the SPNEGO protocol? instead of just asking for user credentials? (the user is logged in through kerberos in the domain.)

Edit: I don't know if this is related but when logging off/on it seems there is no more traffic between client and AD. while i would think at least it should check the credentials... (since the windows-7 should be in the domain)

Also, the IE have the server in local sites.

Someone mentioned that there is a klist command on windows-7.

share|improve this question

For IE 6-8 you need to have the site(s) in Options -> Security -> Local intranet -> Sites.

Firefox go to about:config, filter: network.negotiate-auth.trusted-uris, change to .youdomain.tld, .youseconddomain.tld

Edit: Also make sure the DNS-pointer is an A and not CNAME as windows, belive it or not (atleast in my experience), then provides a kerberos ticket for the final A-pointer.

Kerbtray is a useful tool for debugging the clientside.

Assuming you use Apache as webserver, setting loglevel debug in you vhost conf might give you a clue to what is/isn't happening.

share|improve this answer
I'm using the windows DNS service itself, and it's an A record. I'm not using apache, but connecting to the bundled tomcat at port 8080 directly. I'm using wireshark to see what is happening, but i'll take a look at this kerbtray thing. – Maarten Mar 3 '11 at 9:54
up vote 0 down vote accepted

apparently there was too much fiddling done with the AD and the windows-7 client, i reinstalled both and redone the keytabs and now it works for both HTTP and CIFS

share|improve this answer
Hum. In such case, there is a high chance your SPN has been set on multiple service accounts. The setspn -X command is here to help detect such troubles, and then fix them with setspn -d – Yves Martin Nov 20 '14 at 16:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.