MECH_SPNEGO(7) Standards, Environments, and Macros MECH_SPNEGO(7)


mech_spnego - Simple and Protected GSS-API Negotiation Mechanism




The SPNEGO security mechanism for GSS-API allows GSS-API applications to
negotiate the actual security mechanism to be used in the GSS-API
session. is a shared object module that is dynamically
opened by applications that specify the SPNEGO Object Identifier (OID) in
calls to the GSS-API functions (see libgss(3LIB)).

SPNEGO is described by IETF RFC 2478 and is intended to be used in
environments where multiple GSS-API mechanisms are available to the
client or server and neither side knows what mechanisms are supported by
the other.

When SPNEGO is used, it selects the list of mechanisms to advertise by
reading the GSS mechanism configuration file, /etc/gss/mech (see
mech(5)), and by listing all active mechanisms except for itself.


SPNEGO may be configured to function in two ways. The first way is to
interoperate with Microsoft SSPI clients and servers that use the
Microsoft "Negotiate" method, which is also based on SPNEGO. The
Microsoft "Negotiate" mechanism does not strictly follow the IETF RFC.
Therefore, use special handling in order to enable full interoperability.
In order to interoperate, place option "[ msinterop ]" at the end of the
SPNEGO line in /etc/gss/mech.

This is an example (from /etc/gss/mech):

spnego [ msinterop ]

Without the "[ msinterop ]" option, mech_spnego will follow the strict
IETF RFC 2478 specification and will not be able to negotiate with
Microsoft applications that try to use the SSPI "Negotiate" mechanism.

INTERFACES has no public interfaces. It is only activated and used
through the GSS-API interface provided by (see libgss(3LIB)).



shared object file


SPARC 64-bit shared object file


x86 64-bit shared object file


See attributes(7) for descriptions of the following attributes:

|MT Level | Safe |


Intro(3), libgss(3LIB), mech(5), attributes(7)

Solaris Security for Developers Guide

illumos October 4, 2004 MECH_SPNEGO(7)