According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE.

GET /home


401 Unauthorized

WWW-Authenticate: Negotiate, NTLM

GET /home

Authorization: Negotiate UYTYGHGYKHKJPPP-===


401 Unauthorized

WWW-Authenticate: Negotiate UYUGKJKJKJ+++766==

Get /home

Authorization: Negotiate HJGKJLJLJ+++===


200 OK

WWW-Authenticate: Negotiate UHLKJKJKJJLK===

Who knows what concrete things are done for the three, especially the 2nd one.

P.S. The network environment is work group mode, other than domain mode, and the server is a website hosted on my local PC. In other words, the client (IE) & the server are both in the same machine.

  • I believe that at least two attempts will be required because the client and the server are not in the same domain (since they're both in workgroup mode). On the first attempt the client browser uses the security context of the currently logged in user, which the server doesn't recognize. The second attempt should prompt the user for credentials. Is that what you see when accessing the site? – joeqwerty Nov 8 '13 at 0:29
  • The web site is hosted in the local host. In other words, the client (IE) & server are both in the same machine. – user197658 Nov 8 '13 at 0:41

This is how SPNEGO-based Kerberos and NTLM HTTP authentication works. This is, basically, tunneling the Simple And Protected Negotiate (SPNEGO) and the Generic Security Services Application Program Interface (GSSAPI) protocols over HTTP.

The client attempts to access the resource and receives a 401 with the WWW-Authenticate: Negotiate, NTLM header. The client recognizes that the Negotiate authentication protocol is available and attempts to request the resource again, providing a GSSAPI SPNEGO negotiation message in the Authorization header. The server will respond with another 401 and another `WWW-Authenticate' header. This will continue until the SPNEGO negotiation is complete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.