On 18 Jul 2008, at 12:13, Michael Ströder wrote: > Is the TGT sent by the browser in the SPNEGO blob? Up to now I thought > it's just a service ticket. SPNEGO is a GSSAPI mechanism, wrapping the Kerberos one. If you set the deleg_creds flag when calling into the API, then a TGT will be included. S.