title: Java/SPNEGO: Unwanted SPN canonicalization?
body: <p>I'm currently trying to implement a Java client to an SPNEGO protected web service using the <a href="http://spnego.sourceforge.net/" rel="nofollow noreferrer">SPNEGO library</a> from SourceForge (the server is using the same library). I can not get it to authenticate successfully, my requests always end up as </p>
  
  <pre><code>HTTP/1.1 500 Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
  </code></pre>
  
  <p>This is similar to the symptoms that I get when accessing the web service from a browser with an inappropriate hostname, and indeed some debugging in Wireshark reveals that the client sends a wrong SPN with the request - I send to <code>service-test.client.com</code>, which is registered as an SPN and has an <code>A</code> record in DNS, but is registered in the Windows domain as <code>server-1234.client.corp</code>. Even though I send my request to <code>http://service-test.client.com</code> (see matching <code>Host</code> header), the SPN that Java requests a ticket for is the "internal" Windows name:</p>
  
  <p><img src="https://i.stack.imgur.com/FFqc7.jpg" alt="Wireshark decode of the HTTP request"></p>
  
  <p>The same sent from Chrome or IE has matching <code>Host</code> headers and SPNs:</p>
  
  <p><img src="https://i.stack.imgur.com/aabg6.jpg" alt="enter image description here"></p>
  
  <p>Since there is none of this translation occurs in my code or the SPNEGO library, I presume it must be happening somehwere in the JRE. I've been looking into the JGSS source, but it's a bit hard to understand. Can anyone tell me how to skip this translation and get tickets for the correct SPN? </p>
  
  <p>Client code: </p>
  
  <pre><code>SpnegoHttpURLConnection con = new SpnegoHttpURLConnection("spnego-client", user, password);
  con.connect(new URL("http://service-test.client.com:8083/service"));
  int rc = con.getResponseCode();
  String msg = con.getResponseMessage();
  </code></pre>