Skip to content
This repository


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Jetty (HttpServlet) SPNEGO + PAC demo

branch: master

Fetching latest commit…


Cannot retrieve the latest commit at this time

Octocat-spinner-32 src
Octocat-spinner-32 .gitignore
Octocat-spinner-32 README
Octocat-spinner-32 pom.xml
SPNEGO Servlet + Microsoft PAC demo


This project demonstrates the use of the filter found at[1] as a simple HttpServlet using Jetty. So be sure to read their docs (especially their pre-flight routine).
In addition it also demonstrate the use of the PAC parser found at[2] to parse the PAC information found in an Active Directory (or Samba 4) issued Kerberos ticket[3]. This contains authorization information about the authenticated user principal (think: group information in the form of SID etc.).


Used Settings

Domain username: Zeus
Domain username password: Z3usP@55

        default_realm = EXAMPLE.COM
	forwardable = true

        EXAMPLE.COM = {
                kdc =
		default_domain = EXAMPLE.COM
		kpasswd_server =

[domain_realm] = EXAMPLE.COM = EXAMPLE.COM

        krb4_convert = true
        krb4_get_tickets = false

Browser configuration:

1) IE:  Configure trusted websites to include "" and allow negotiation for that website (@TODO be more specific)
2) Google-chrome:  start from command line with: google-chrome --auth-server-whitelist="*" --auth-negotiate-delegate-whitelist="*"
3) Firefox: go to about:config, "say you'll be careful", change the value for 'network.negotiate-auth.trusted-uris' into 'https://,' and the value for 'network.negotiate-auth.delegation-uris' into ''

Build/Run Instructions

Build/run using: mvn jetty:run         (and have a cup of tea (coffee), if you happen to have an empty local maven repo)

Available Servlets


	Shows how to use the forked spnego-pac filter to authenticate users against a Kerberos (i.e. Active Directory) and how to read the logon info (PAC, e.g. group SID) from the authenticated principal (for kerberos tickets issues by Active Directory, Samba v4).


	Works like 1) but exposes the underlying code in a single file (for people who like to know how it works).


1) If your client is on a POSIX platform (Linux, etc.), be sure to run 'kinit' first, otherwise you will not be able to authenticate and the browsers won't tell you what is happening.
2) In Windows you cannot run the server and the client on the same host, because Windows will try to use NTLM then, which you don't want because it's insecure.
3) There are probably more caveats that I now fail to remember/mention, sorry about that.

Something went wrong with that request. Please try again.