Hello! I have a question about cURL and Negotiate/Kerberos authentication and the used SPN (server principal name) on Windows.
If the URL does not contain a canonical host name of the target server (just a simple non-FQDN-name like "http://myhost/path"; or just an IP address), then the SPN generated by cURL which is passed to the windows API function "InitializeSecurityContext" is "HTTP/myhost" (or with IP address), but the documentation says that there should be passed a canonical host name, like "HTTP/myhost.mycompany.org" if possible. When analyzing the source code of cURL I can only find paths through the code wich just take the host name from the URL and no name resolution takes place. Google Chrome and Firefox explicitly pass a resolved FQDN host name in the SPN if available. cURL: The used host is either [connectdata]->host.name or [connectdata]->http_proxy.host.name which comes directly from the passed URL. Google Chrome source code: https://cs.chromium.org/chromium/src/net/http/http_auth_handler_negotiate.cc?type=cs&l=155 Firefox source code: https://dxr.mozilla.org/mozilla-central/source/extensions/auth/nsAuthSSPI.cpp#228 Is there something missing in cURL? Or do I have to resolve and replace the host name in the URL before passing it to cURL? Regards, Dominik ------------------------------------------------------------------- Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library Etiquette: https://curl.haxx.se/mail/etiquette.html
