{"record":{"id":"54882cb7aa0304eb","repo":"spring-projects/spring-security","slug":"negotiate-header-was-invalid-s","errorCode":null,"errorMessage":"Negotiate Header was invalid: %s","messagePattern":"Negotiate Header was invalid: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"kerberos/kerberos-web/src/main/java/org/springframework/security/kerberos/web/authentication/SpnegoAuthenticationProcessingFilter.java","lineNumber":184,"sourceCode":"\t\t\t\t|| header.startsWith(\"Kerberos \"))) {\n\t\t\tif (this.logger.isDebugEnabled()) {\n\t\t\t\tthis.logger.debug(\"Received Negotiate Header for request \" + request.getRequestURL() + \": \" + header);\n\t\t\t}\n\t\t\tbyte[] base64Token = header.substring(header.indexOf(\" \") + 1).getBytes(\"UTF-8\");\n\t\t\tbyte[] kerberosTicket = Base64.getDecoder().decode(base64Token);\n\t\t\tKerberosServiceRequestToken authenticationRequest = new KerberosServiceRequestToken(kerberosTicket);\n\t\t\tauthenticationRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));\n\t\t\tAuthentication authentication;\n\t\t\ttry {\n\t\t\t\tif (this.authenticationManager == null) {\n\t\t\t\t\tthrow new IllegalStateException(\"authenticationManager must be set\");\n\t\t\t\t}\n\t\t\t\tauthentication = this.authenticationManager.authenticate(authenticationRequest);\n\t\t\t}\n\t\t\tcatch (AuthenticationException ex) {\n\t\t\t\t// That shouldn't happen, as it is most likely a wrong\n\t\t\t\t// configuration on the server side\n\t\t\t\tthis.logger.warn(\"Negotiate Header was invalid: \" + header, ex);\n\t\t\t\tthis.securityContextHolderStrategy.clearContext();\n\t\t\t\tif (this.failureHandler != null) {\n\t\t\t\t\tthis.failureHandler.onAuthenticationFailure(request, response, ex);\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\tresponse.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);\n\t\t\t\t\tresponse.flushBuffer();\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis.sessionStrategy.onAuthentication(authentication, request, response);\n\n\t\t\tSecurityContext context = this.securityContextHolderStrategy.createEmptyContext();\n\t\t\tcontext.setAuthentication(authentication);\n\t\t\tthis.securityContextHolderStrategy.setContext(context);\n\t\t\tthis.securityContextRepository.saveContext(context, request, response);\n\t\t\tif (this.successHandler != null) {\n\t\t\t\tthis.successHandler.onAuthenticationSuccess(request, response, authentication);","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-web/src/main/java/org/springframework/security/kerberos/web/authentication/SpnegoAuthenticationProcessingFilter.java#L166-L202","documentation":"SpnegoAuthenticationProcessingFilter.doFilterInternal logs this warning when the AuthenticationManager throws an AuthenticationException while authenticating the SpnegoAuthenticationToken built from the Authorization: Negotiate header. Since a bad client token normally means 'continue the handshake' rather than an exception, this signals a server-side problem: Kerberos validation of the ticket failed. The security context is cleared and the failure handler runs (defaulting to HTTP 500).","triggerScenarios":"A browser sends a Negotiate header with a service ticket, SunJaasKerberosTicketValidator fails to validate it (keytab mismatch with the service principal, wrong SPN registered by the client, clock skew > 5 min, ticket replay, KDC unreachable), and authenticationManager.authenticate() throws, hitting the catch block at SpnegoAuthenticationProcessingFilter.java:184.","commonSituations":"Keytab generated for a different SPN than the URL the client resolved (e.g. HTTP/host@REALM mismatch); duplicate SPN registrations (setspn -X); AD/FreeIPA KDC not reachable from the app server; host clocks out of sync; outdated kerb5.conf/JAAS config; replayed cached tickets from a load-balanced setup without proper SPN setup.","solutions":["Verify the keytab matches the service principal and the SPN the client uses (HTTP/fqdn@REALM); re-export with ktpass/kadmin if needed and confirm with `klist -k keytab`.","Check the full warning stack trace in the logs — the underlying GSS/KrbException (e.g. 'Clock skew too great', 'Key version number for principal in key table is incorrect') names the root cause.","Ensure server clock sync with the KDC (NTP) within the 5-minute skew window, and confirm kvno consistency between KDC and keytab.","Validate KDC reachability and krb5.conf (default_realm, realms, dns_lookup) on the app server; test with `kinit -k -t keytab principal`."],"exampleFix":"// before (bean wiring SPN that doesn't match the keytab)\nvalidator.setServicePrincipal(\"HTTP/wrong-host@EXAMPLE.COM\");\n\n// after\nvalidator.setServicePrincipal(\"HTTP/app.example.com@EXAMPLE.COM\"); // matches keytab & client SPN\nvalidator.setKeyTabLocation(new FileSystemResource(\"/etc/security/app.keytab\"));","handlingStrategy":"try-catch","validationCode":"// before deploying: verify keytab/SPN/KDC from the server host\n// klist -k /etc/security/app.keytab\n// kinit -k -t /etc/security/app.keytab HTTP/app.example.com@EXAMPLE.COM","typeGuard":null,"tryCatchPattern":"The filter handles the AuthenticationException internally (clears the context, invokes failureHandler, default 500). Provide a custom failureHandler: filter.setFailureHandler((req, res, ex) -> { log.warn(\"SPNEGO failed\", ex); res.sendError(HttpServletResponse.SC_BAD_REQUEST, \"Invalid Negotiate token\"); }); and correlate with the logged stack trace for the root KrbException.","preventionTips":["Match service principal exactly to the SPN clients request (HTTP/<fqdn>@REALM); check with setspn -L / kadmin lookups.","Keep server clocks NTP-synced with the KDC (skew limit ~5 minutes).","Ensure krb5.conf and JAAS config on the server are correct and the KDC is reachable from the app host.","Keep keytab kvno in sync with the KDC; regenerate via ktpass/kadmin after password/key changes.","Monitor for this warning — recurring occurrences indicate server/KDC configuration, not client issues."],"tags":["kerberos","spnego","authentication","http-header","sso"],"backgroundTag":"kerberos-ticket-validation-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}