Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Jetty (HttpServlet) SPNEGO + PAC demo


SPNEGO Servlet + Microsoft PAC demo


This project demonstrates the use of the filter found at[1] as a simple HttpServlet using Jetty. So be sure to read their docs (especially their pre-flight routine).
In addition it also demonstrate the use of the PAC parser found at[2] to parse the PAC information found in an Active Directory (or Samba 4) issued Kerberos ticket[3]. This contains authorization information about the authenticated user principal (think: group information in the form of SID etc.).


Used Settings

Domain username: Zeus
Domain username password: Z3usP@55

        default_realm = EXAMPLE.COM
	forwardable = true

        EXAMPLE.COM = {
                kdc =
		default_domain = EXAMPLE.COM
		kpasswd_server =

[domain_realm] = EXAMPLE.COM = EXAMPLE.COM

        krb4_convert = true
        krb4_get_tickets = false

Browser configuration:

1) IE: Add to the "Local intranet" zone. For this, click the Settings Gear in IE->Internet Options->Security->Local intranet->Sites->Advanced. Then add ""
2) Google-chrome:
* On Windows: Use the IE configuration steps above; or
* On Linux (or Windows): start from command line with: google-chrome --auth-server-whitelist="*" --auth-negotiate-delegate-whitelist="*"
3) Firefox: go to about:config, "say you'll be careful", change the value for 'network.negotiate-auth.trusted-uris' into 'https://,' and the value for 'network.negotiate-auth.delegation-uris' into ''

Build/Run Instructions

Build/run using: mvn jetty:run         (and have a cup of tea (coffee), if you happen to have an empty local maven repo)

Available Servlets


	Shows how to use the forked spnego-pac filter to authenticate users against a Kerberos (i.e. Active Directory) and how to read the logon info (PAC, e.g. group SID) from the authenticated principal (for kerberos tickets issues by Active Directory, Samba v4).


	Works like 1) but exposes the underlying code in a single file (for people who like to know how it works).


1) If your client is on a POSIX platform (Linux, etc.), be sure to run 'kinit' first, otherwise you will not be able to authenticate and the browsers won't tell you what is happening.
2) In Windows you cannot run the server and the client on the same host, because Windows will try to use NTLM then, which you don't want because it's insecure.
3) There are probably more caveats that I now fail to remember/mention, sorry about that.

Something went wrong with that request. Please try again.