title: Choosing Kerberos (SPNEGO) Java library for web application single sign-on
body: <p>I'm currently working on implementing enterprise authentication mechanisms in our Java web-application, including single sign-on. Windows networks are what we primary target at, and Kerberos sounds a reasonable choice. Sidenote: as far as I understand, the protocol used in web (HTTP) environment to SSO is SPNEGO, and it's basically a wrapper around Kerberos. Thus it sounds that Kerberos HTTP SSO libraries in fact are using SPNEGO -- correct me if I'm wrong. </p>
  
  <p>As I started investigating this topic, I realized that there's no obvious choice. Let me list those:</p>
  
  <ol>
  <li><a href="http://static.springsource.org/spring-security/site/extensions/krb/index.html" rel="nofollow noreferrer">Spring security Kerberos/SPNEGO extension</a>. This was the first I looked at (as we are already using Spring security), but it seems to be stuck at v1.0.0 second milestone few years ago. Only this <a href="https://stackoverflow.com/questions/11040883/spring-security-kerberos-extension-for-production-use">SO question</a> gives slight hope it could be used for production.</li>
  <li><a href="http://dblock.github.com/waffle/" rel="nofollow noreferrer">WAFFLE - Windows Authentication Functional Framework</a>. Seems to be active and feature-rich. It can be 'plugged' as generic servlet, and also as a <a href="http://code.dblock.org/single-sign-on-spring-security-negotiate-filter-kerberos-ntlm-wwaffle" rel="nofollow noreferrer">Spring security filter</a>.</li>
  <li><a href="http://spnego.sourceforge.net/index.html" rel="nofollow noreferrer">SPNEGO SourceForge</a>. Seems very lightweight, provides HTTP Servlet filter, tutorials are easy to follow.</li>
  </ol>
  
  <p>Are there any particular reasons to choose one option over the other? Are there any other options around?</p>