title: curl: how to use Kerberos instead of NTLM authentication on Windows?
body: <p>I'm trying to connect to a Livy REST service under Kerberos security. On Linux CentoS <code>curl</code> works fine with <code>negotiate</code>, after receiving a Kerberos <code>kinit</code> ticket the connection through</p>
  
  <pre><code>curl --negotiate -u : http://service_link
  </code></pre>
  
  <p>The problem I'm facing is trying to do the same on remote Windows desktop. I'm using MIT Kerberos for Windows, which is able to do a successful <code>kinit</code>. However, <code>curl</code> seems to be negotiating using the NTLM SSL tickets instead of Kerberos, which results in the following error:</p>
  
  <pre><code>AuthenticationFilter: Authentication exception: org.apache.hadoop.security.authentication.client.AuthenticationException
  </code></pre>
  
  <p>I've tried using the <a href="https://curl.haxx.se/download.html" rel="nofollow noreferrer">official curl release for windows</a>, having these features (<code>curl --version</code>):</p>
  
  <pre><code>Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
  Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 HTTPS-proxy
  </code></pre>
  
  <p>and the <a href="https://github.com/bmatzelle/gow/" rel="nofollow noreferrer">gow 0.8.0 version of curl</a>:</p>
  
  <pre><code>Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
  Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM SPNEGO SSL SSPI libz
  </code></pre>
  
  <p>Both of these use NTLM SLL when negotiating. </p>
  
  <p>Question: Is there a way to force using Kerberos instead of NTLM? Is it possible to debug the Negotiator to see whether (and where) it is looking for Kerberos (and possibly not seeing) tickets? </p>
  
  <p>Concerning the Kerberos, it seems to be storing the keytabs on its api, so I've set the <code>KRB5CCNAME</code> environment variable to <code>API:Initial default ccache</code>; <code>klist</code> is able to see the ticket, however, maybe <code>curl</code> needs additional specification?</p>
  
  <p>Also -- are there alternative methods to <code>curl</code> for such connection with Kerberos security?</p>