# I patched the spnego module

**URL:** <https://www.ruby-forum.com/t/i-patched-the-spnego-module/216828>\
**Category:** NGINX\
**Created:** [February 15, 2012, 8:46am UTC](https://www.ruby-forum.com/t/i-patched-the-spnego-module/216828 "2012-02-15T08:46:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 15, 2012, 8:46am UTC](https://www.ruby-forum.com/t/i-patched-the-spnego-module/216828/1 "2012-02-15T08:46:17Z")

</div>

Hi,

i only want to announce, that i patched the spnego module, so you can  
use it as  
a 100% replacement to apache2+mod\_auth\_kerb.

> **[GitHub - muhgatus/spnego-http-auth-nginx-module: SPNEGO HTTP Authentication...](https://github.com/muhgatus/spnego-http-auth-nginx-module)**
>
> SPNEGO HTTP Authentication Module for nginx. Contribute to muhgatus/spnego-http-auth-nginx-module development by creating an account on GitHub.

I installed in on 3 hosts running now for about 2 weeks without an  
error.  
Perhaps somebody wants to test it too? 🙂

bye MUH!

–  
; **;** _,  
)…(_=\_)  
(oo)| |  
#!/usr/bin/env python  
domain={‘[r4w.de](http://r4w.de)’: ‘i hate perl’}  
domainparts=[‘python’,‘blog’,‘r4w’,‘de’]  
print domain[‘.’.join(domainparts[[i for i in range(0,len(domainparts)) if domain.has\_key(‘.’.join(domainparts[i:]))][0]:])]

---

<div class="post-metadata">

**Author:** ![lesven](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/71e660/32.png) [@lesven](https://www.ruby-forum.com/u/lesven)\
**Post date:** [February 15, 2012, 6:59pm UTC](https://www.ruby-forum.com/t/i-patched-the-spnego-module/216828/2 "2012-02-15T18:59:39Z")

</div>

On Tue, Feb 14, 2012 at 11:45 PM, Sven L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Hi,
> 
> i only want to announce, that i patched the spnego module, so you can use it as  
> a 100% replacement to apache2+mod\_auth\_kerb.
> 
> [GitHub - muhgatus/spnego-http-auth-nginx-module: SPNEGO HTTP Authentication Module for nginx · GitHub](https://github.com/muhgatus/spnego-http-auth-nginx-module)
> 
> I installed in on 3 hosts running now for about 2 weeks without an error.  
> Perhaps somebody wants to test it too? 🙂

Was this based off off of my work I funded?

> **[GitHub - mike503/spnego-http-auth-nginx-module: SPNEGO HTTP Authentication Module for nginx](https://github.com/mike503/spnego-http-auth-nginx-module)**
>
> SPNEGO HTTP Authentication Module for nginx

I just got a blog reply a couple days ago saying someone had got it  
working, which was the first time I had got a positive reply (since my  
corporate network seems so complex I can’t test it on my own still…)

> **[SPNEGO For nginx - a start, at least](https://michaelshadle.com/2010/01/17/spnego-for-nginx-a-start-at-least)**
>
> I've been posting on the nginx mailing lists for a while that I've had a developer working on SPNEGO (Kerberos/GSSAPI/etc.) module for authentication for nginx. I never produced…

It would be great to have a working module for this, there was  
interest in it when I brought it up a couple years ago, but then  
nobody helped extend or test it 🙂

I would love to talk offline, maybe there is something you’re doing  
vs. mine (I didn’t code it, only sponsor it) but obviously I want the  
most mature and extensible module out there.

From my understanding if Kerberos fails it’s supposed to fall back to  
digest, but nginx did not support digest yet (only basic), someone  
once summarized it for me and it is in my notes somewhere.

---

<div class="post-metadata">

**Author:** ![lesven](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/71e660/32.png) [@lesven](https://www.ruby-forum.com/u/lesven)\
**Post date:** [February 15, 2012, 7:11pm UTC](https://www.ruby-forum.com/t/i-patched-the-spnego-module/216828/3 "2012-02-15T19:11:26Z")

</div>

On 02-15 09:59, Michael S. wrote:

> Was this based off off of my work I funded?  
> [GitHub - mike503/spnego-http-auth-nginx-module: SPNEGO HTTP Authentication Module for nginx · GitHub](https://github.com/mike503/spnego-http-auth-nginx-module)

yes, it is.

> From my understanding if Kerberos fails it’s supposed to fall back to  
> digest, but nginx did not support digest yet (only basic), someone  
> once summarized it for me and it is in my notes somewhere.

i only added basic auth to it in order if the browser does not  
support negotiation then it will fall back to basic-auth and checks the  
given password against kerberos.

i do not know how the get the digest auth working. basic auth was  
simple. i  
modified the code within a couple of hours.

> It would be great to have a working module for this, there was  
> interest in it when I brought it up a couple years ago, but then  
> nobody helped extend or test it 🙂

i started to replace apache installations by nginx. so, here is my test  
result:

it works 😉

> I would love to talk offline, maybe there is something you’re doing  
> vs. mine (I didn’t code it, only sponsor it) but obviously I want the  
> most mature and extensible module out there.

so, you might merge my changes back to your repository on github.