title: curl on Windows: "GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)"
body: <p>I want to access a service that uses Kerberos authentication. The service admin gave me a <code>spnego.service.keytab</code> file for the correct Kerberos principal and realm. I can run <code>kinit</code> against that keytab file to get a Kerberos ticket successfully. But when I try to access that service using curl in a Windows 7 laptop outside the cluster I get this error:</p>
  
  <pre><code>org.apache.hadoop.security.authentication.client.AuthenticationException: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
  </code></pre>
  
  <p>The service happens to be <a href="http://livy.incubator.apache.org/" rel="nofollow noreferrer">Livy</a> but a colleague gets the same error using Oozie on the same cluster so I don't think the details of the service itself matters much.</p>
  
  <p>Here are the full details:</p>
  
  <pre><code>&gt;curl --negotiate -u : http://&lt;livy_server_host&gt;:&lt;port&gt;/sessions/
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/&gt;
  &lt;title&gt;Error 403 &lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;h2&gt;HTTP ERROR: 403&lt;/h2&gt;
  &lt;p&gt;Problem accessing /sessions/. Reason:
  &lt;pre&gt;    org.apache.hadoop.security.authentication.client.AuthenticationException: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)&lt;/pre&gt;&lt;/p&gt;
  &lt;hr /&gt;&lt;i&gt;&lt;small&gt;Powered by Jetty://&lt;/small&gt;&lt;/i&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>What needs to be done to make the curl command work?</p>