How to get NegotiateStream to use Kerberos?

Question

After asking this question, I've been trying to use NegotiateStream to authenticate a Windows client against a Java server. It seems that Java doesn't have great NTLM library support, so I've been working on the assumption that I'd have to use Kerberos, which Java seems to support much better (via the GSS-API).

The problem is that NegotiateStream seems to be attempting to use NTLM every time. The documentation suggests that it could use either, but doesn't specify how it chooses. I can't see any options in the API to control which mechanism it chooses. Is there a way?

I've got myself a Service Principal Name and my client code looks like this:

string spn = "<service-name>/<my-pc-name>"
TcpClient client = new TcpClient(server, port);
NetworkStream stream = client.GetStream();
NegotiateStream neg = new NegotiateStream(stream, true);
neg.AuthenticateAsClient(CredentialCache.DefaultNetworkCredentials, spn);

On the server end, the first set of bytes received are 22,1,0,0,59 and then "NTLMSSP" - which I wasn't expecting.

I've tried a few different formats for the SPN string, not sure what the correct format is there. I originally created the SPN with

setspn -A <service-name>/<my-pc-name>.<domain-name> <my-user-name>

setspn -L lists it successfully as:

TEST/<my-pc-name>.<domain-name>

Am I doing something wrong, or completely misunderstanding this stuff? :)

Answer 1

The full syntax for an SPN name is <service>/<user>@DOMAIN; apparently, it is possible to omit the domain name. However, if the username is my-pc-name.domain-name, then you shouldn't shorten it further - provide the SPN exactly as spn -L lists it to you.