From fdeff6e2bfff5ce8491f7f2f80c3c992e711a29d Mon Sep 17 00:00:00 2001 From: Aayush Atharva Date: Fri, 17 Jul 2026 20:03:28 +0000 Subject: [PATCH] Bind origin Kerberos/SPNEGO token to the origin service, not the proxy perConnectionAuthorizationHeader built the origin realm's Negotiate token against proxyServer.getHost() whenever a proxy was configured, producing a service ticket for the proxy's SPN. That is a confused deputy: the origin credential is delivered to, and only usable by, the proxy, while origin authentication fails. Always target the origin host (virtualHost or the request host); the proxy realm keeps its own per-connection path. --- .../asynchttpclient/util/AuthenticatorUtils.java | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java b/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java index bd9ee8bb2..46a776296 100644 --- a/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java +++ b/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java @@ -596,14 +596,11 @@ private static void appendQuotedStringContent(StringBuilder builder, @Nullable S break; case KERBEROS: case SPNEGO: - String host; - if (proxyServer != null) { - host = proxyServer.getHost(); - } else if (request.getVirtualHost() != null) { - host = request.getVirtualHost(); - } else { - host = request.getUri().getHost(); - } + // The origin realm's Negotiate token must target the origin service even when a proxy + // is configured. Minting it against the proxy host produced a service ticket for the + // proxy's SPN: a confused deputy where the origin credential is delivered to, and only + // usable by, the proxy, while origin authentication fails. + String host = request.getVirtualHost() != null ? request.getVirtualHost() : request.getUri().getHost(); try { authorizationHeader = NEGOTIATE + ' ' + SpnegoEngine.instance(