To run with Spengo enabled the following command line options are required:

-Djava.security.krb5.conf=/path/to/jetty/etc/krb5.ini \
-Djava.security.auth.login.config=/path/to/jetty/etc/spnego.conf \
-Djavax.security.auth.useSubjectCredsOnly=false

For debugging the Spengo authentication the following options are very helpful:

-Dorg.eclipse.jetty.LEVEL=debug \
-Dsun.security.spnego.debug=all

Spengo Authentication must be enabled in the webapp in the following way. The name of the role will be different for your network.

 <security-constraint>
   <web-resource-collection>
     <web-resource-name>Secure Area</web-resource-name>
     <url-pattern>/secure/me/*</url-pattern>
   </web-resource-collection>
   <auth-constraint>
     <!-- this is the domain that the user is a member of -->
     <role-name>MORTBAY.ORG</role-name>
   </auth-constraint>
 </security-constraint>
 <login-config>
   <auth-method>SPNEGO</auth-method>
   <realm-name>Test Realm</realm-name>
   <!-- optionally to add custom error page -->
   <spnego-login-config>
     <spengo-error-page>/loginError.html?param=foo</spnego-error-page>
   </spnego-login-config>
 </login-config>

A corresponding UserRealm needs to be created either programmatically if embedded, via the jetty.xml or in a context file for the webapp.

This is what the configuration within a Jetty xml file would look like.

  <Call name="addBean">
     <Arg>
       <New class="org.eclipse.jetty.security.SpnegoLoginService">
         <Set name="name">Test Realm</Set>
         <Set name="config"><Property name="jetty.home" default="."/>/etc/spnego.properties</Set>
       </New>
     </Arg>
   </Call>

This is what the configuration within a context xml file would look like.

 <Get name="securityHandler">
   <Set name="loginService">
     <New class="org.eclipse.jetty.security.SpnegoLoginService">
       <Set name="name">Test Realm</Set>
       <Set name="config">
        <SystemProperty name="jetty.home" default="."/>/etc/spnego.properties
      </Set>
     </New>
   </Set>
   <Set name="checkWelcomeFiles">true</Set>
 </Get>

There are a number of important configuration files with S3pnego that are required. The default values for these configuration files from this test example are found in the /etc folder of the Jetty distribution.

It is important to note that the keytab file referenced in the krb5.ini and the spengo.conf files needs to contain the keytab for the targetName for the http server. To do this use a process similar to this:

On the Windows Active Domain Controller run:

$ setspn -A HTTP/linux.mortbay.org ADUser

To create the keytab file use the following process:

$ ktpass -out c:\dir\krb5.keytab -princ HTTP/[email protected] -mapUser ADUser -mapOp set -pass ADUserPWD -crypto RC4-HMAC-NT -pType KRB5_NT_PRINCIPAL

This step will give you the keytab file which should then be copied to the machine running the http server and referenced from the configuration files. For our testing we put the keytab into the /etc directory of Jetty and referenced it from there.

The follows steps have been required to inform Firefox that it should use a negotiation dialog to authenticate.

The follows steps have been required to inform Internet Explorer that it should use a negotiation dialog to authenticate.