The JBoss standalone.xml, if it could help :

<security-domain name="host" cache-type="default">
    <authentication>
        <login-module code="Kerberos" flag="sufficient">
            <module-option name="storeKey" value="true"/>
            <module-option name="useKeyTab" value="true"/>
            <module-option name="principal" value="HTTP/testserver@SSO.TEST"/>
            <module-option name="keyTab" value="/sso/testserver.http.keytab"/>
            <module-option name="doNotPrompt" value="true"/>
            <module-option name="debug" value="true"/>
            <module-option name="defaultRole" value="Users"/>
        </login-module>
    </authentication>
</security-domain>
<security-domain name="SPNEGO" cache-type="default">
    <authentication>
        <login-module code="SPNEGO" flag="sufficient">
            <module-option name="password-stacking" value="useFirstPass"/>
            <module-option name="serverSecurityDomain" value="host"/>
            <module-option name="defaultRole" value="Users"/>
            <module-option name="debug" value="true"/>
        </login-module>
        <login-module code="LdapExtended" flag="sufficient">
            <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
            <module-option name="java.naming.provider.url" value="ldap://X.X.X.X:389"/>
            <module-option name="bindDN" value="cn=testsso,ou=myou,dc=sso,dc=test"/>
            <module-option name="bindCredential" value="******"/>
            <module-option name="baseCtxDN" value="ou=myou,dc=sso,dc=test"/>
            <module-option name="baseFilter" value="(sAMAccountName={0})"/>
            <module-option name="rolesCtxDN" value="ou=myou,dc=sso,dc=test"/>
            <module-option name="roleFilter" value="(sAMAccountName={0})"/>
            <module-option name="roleAttributeID" value="memberOf"/>
            <module-option name="roleNameAttributeID" value="cn"/>
            <module-option name="roleAttributeIsDN" value="true"/>
            <module-option name="allowEmptyPasswords" value="false"/>
            <module-option name="Context.REFERRAL" value="follow"/>
            <module-option name="throwValidateError" value="true"/>
            <module-option name="searchScope" value="SUBTREE_SCOPE"/>
            <module-option name="allowEmptyPasswords" value="true"/>
            <module-option name="defaultRole" value="Users"/>
        </login-module>
    </authentication>
</security-domain>

I have more information :

I think I have to accept that Kerberos authentication works only with domain names, not IP addresses.

For my second question, I performed a new test. When I access the application from a computer logged in another AD domain, I get too an HTTP 401 error. So I guess that if authentication can't be done, I got the login form, but when authentication fail (IP address, or bad Kerberos token) I get an 401 error. Is it a way to get the login form instead ?

Ok I'll do it, but you mean I get this error because of a bad configuration of my browser. I tried it both with Firefox and IE, and I get the same issue trying to access by IP adress, or by name from another domain.

What shoul I do ?

Could you help me implement the feature ? What should I do to send the login form once the unsupported negotiation mecanism is detected in the SPNEGOLoginModule ?

Ok,

If I redirect to the login form, how can I give the url to redirect to after successful login ?

I'll test with a FilterServlet, but I have to check if the HttpServletResponse object contains a 401 HTTP Error ? How ?

Hum...I don't think there is a solution for my problem there...

Negotitation works well in common configurations, but there are two use cases still to improve :

-> Connexion with IP adress in the URL : I wrote a filter according to your advice which rewrite URL, replacing IP by hostname.

-> Connexion from a computer of another domain. : No solution for the moment.

These two cases result in an 'Unsupported mechanism NTLM' . I wrote a feature request, but I need to find a solution quickly. Waiting for this feature, I think I could use the fallback login module (LDAP) with a login form to another domain's users. The fallback perfectly works for non domain users. I don't understand why the browser attempt to use NTLM while the browser can use SPNEGO and it's only a wrong token (from another domain).

So, I was thinking your idea (Servlet Filter) would permit me to catch 401 error and to redirect browser to the login form, instead of displaying HTTP error. But the two questions I can't answer are :

• how to catch 401 error ? Using HTTPServletResponse ?
• If I redirect to login form, how to specify which URL will the user be redirect to after successful login ? That seems to be impossible to specify.

Any idea ?

I used this web.xml as example to configure my application, so I don't understand what you want to show me ?

I'm having same 2 described issues using my application or the negotiation toolkit.

EDIT :

Please read my messages : the fallback works well in main use cases, I'm having issues only for two particular cases.