We're in the process of testing out SPNEGO support for an Apigee API proxy. I'm using the API sample found here as the basis for my proxy. Everything is configured, and now it's time to test. I'm running:

curl -vki --negotiate -u : https://<my Apigee endpoint>/<my proxy>

In doing so, however, I see that my Authorization header is sending an NTLM negotiation, rather than a Kerberos negotiation. This is problematic, as the code for the proxy is configured to use GSSAPI to provide Kerberos support.

Does anyone know of a way to force curl to use Kerberos rather than NTLM as the negotiation? I haven't been able to track down any way of doing it thus far, but figured I'd ask here.

EDIT: Here is the output showing my version of curl...

$ curl -V curl 7.47.1 (x86_64-w64-mingw32) libcurl/7.47.1 OpenSSL/1.0.2g zlib/1.2.8 libidn/1.32 libssh2/1.7.0 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp

Features: IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP

  • Was your version of curl compiled with GSSAPI and Kerberos support? Check with curl --version. – Michael Hampton Nov 20 at 20:28
  • Edited to show that it is built with SPNEGO and Kerberos support – Shadowman Nov 21 at 13:09
  • But it doesn't have GSSAPI. That's interesting. – Michael Hampton Nov 21 at 13:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.