title: Why does IE not send the Kerberos ticket information to my JBoss on Linux?
body: <p>I'm trying to implement SSO using a Windows client and JBoss. Own my development PC, JBoss runs on Windows 7, on the development server, it runs on (Red Hat) Linux.</p>
  
  <p>There's a <a href="http://www.jboss.org/picketbox/downloads" rel="noreferrer" title="JBoss Negotiation Toolkit">JBoss Negotiation Toolkit</a> which allows me to check whether the Negiation header is arriving correctly.</p>
  
  <p>The <code>BasicNegotiation</code> test works fine as long as I have JBoss running on my own PC, using <code>localhost</code>. The sent header is</p>
  
  <blockquote>
    <p><code>Authorization: Negotiate YHgGBisGAQUFAqBuMGygMDAuBgorBgEEAYI3AgIKB...</code> (plus some more bytes)</p>
  </blockquote>
  
  <p>The test's response is</p>
  
  <blockquote>
    <p>Negotiation Toolkit
    Basic Negotiation
    WWW-Authenticate - Negotiate YHgGBisGAQUFAqBuMGygMDAuBgorBgEEAYI3AgIK... </p>
    
    <p>NegTokenInit
    Message Oid - SPNEGO
    Mech Types - {NTLM} {Kerberos V5 Legacy} {Kerberos V5} {1.3.6.1.4.1.311.2.2.30}
    Req Flags -
    Mech Token -TlRMTVNTUAABAAAAl7II4gQABAAyAAAACgAKACgAAAAGAbAdAAAAD0lQSUVWMTAwMjVJUElF
    Mech List Mic -</p>
  </blockquote>
  
  <p>But on the Linux server, the same test doesn't work. The base reason (I guess) is that the header looks different:</p>
  
  <blockquote>
    <p><code>Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==</code></p>
  </blockquote>
  
  <p>And then the JBoss Negotiation Toolkit makes a fallback to NTML Authentication, which I don't want and which appears as error in the webapp's output.</p>
  
  <blockquote>
    <p>Negotiation Toolkit
    NTLM Negotiation
    WWW-Authenticate - Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw== </p>
    
    <p>NTLM - Negotiate_Message
    Warning, this is NTLM, only SPNEGO is supported!
    Negotiate Flags - (encryption56Bit)(explicitKeyExchange)(sessionKeyExchange128Bit)
    negotiateVersion)(ntlm2)(alwaysSign)(ntlm)(lmKey)(sign)(requestTarget)(oem)(unicode)
    Domain Name = null - {length=0}{maxLength=0}{offset=0}
    Workstation Name = null - {length=0}{maxLength=0}{offset=0}
    Version - ?</p>
  </blockquote>
  
  <p>I configured both Internet Explorer and Firefox to send the Negotiation header, and they both fail with the Linux server.</p>
  
  <p>What am I doing wrong?</p>
  
  <p>By the way: I read somewhere that Windows always sends the Kerberos Negotiation header on local machines - is that true?</p>