https://insinuator.net/authors/simon-rich/ Recent content in Simon Rich on Insinuator.net - Bold Statements Hugo en-us Thu, 18 Feb 2016 00:00:00 +0000 https://insinuator.net/2016/02/how-to-test-kerberos-authenticated-web-applications/ Thu, 18 Feb 2016 00:00:00 +0000 https://insinuator.net/2016/02/how-to-test-kerberos-authenticated-web-applications/ <p>First of all: This is not an in-depth Kerberos how-to, nor is this tutorial about the different aspects of web application testing. This tutorial is just to give support in testing Kerberos authenticated web applications. The goal is to hand over the right tools and steps to be able to perform the configuration and be able to test the application.</p> <p><strong>When to use it?</strong><br> When there is a 401 server response with the header “WWW-Authenticate: Negotiate”. This can either mean Kerberos or NTLM authentication is needed. It is possible to distinguish them by looking at valid authenticated client traffic. As a simple reminder: The NTLM Authorization header will always start with the value “TlRM…”, the Kerberos Authorization header will always start with “YII…”. For further information this <a href="http://blogs.technet.com/b/tristank/archive/2006/08/02/negotiate-this.aspx">link</a> is recommend.<br> In this tutorial the term “Kerberos authentication” will be used. There are other terms sometimes used like SPNEGO, SSO or integrated authentication.</p>