SPNEGO and Windows AD

### Describe the bug

I was not sure under which category to open this issue but settled it as a bug, feel free to change it if this was a mistake.

I do have a problem trying to use SPNEGO with Windows AD and even with extensive testing/trying, I could not figure out what is wrong.

I am not unfamiliar with SPNEGO and IWA and I already use it for services like Azure login, synology etc and they work reasonably well.

However, for authentik I could not get it to work. I will briefly explain the steps I took and do please let me know if I have gone wrong somewhere.

Created an AD user in DC then set the encryption settings for it

`Set-ADUser -Identity "authentik-spnego" -Replace @{'msDS-SupportedEncryptionTypes' = 24}`

set the SPN for Authentik for that user

`setspn -S HTTP/authentik.domain.com DOMAIN\authentik-spnego`

double checked the SPN

```
setspn -Q HTTP/authentik.domain.com
setspn -X
```

created a keytab

```
ktpass /princ HTTP/authentik.domain.com@DOMAIN.COM `
/mapuser DOMAIN\authentik-spnego `
/crypto AES256-SHA1 `
/ptype KRB5_NT_PRINCIPAL `
/pass "PASSWORD" `
/out C:\authentik-spnego.keytab
```

and lastly, get the base64 for that keytab

`[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\authentik-spnego.keytab"))`

My users are already synced with Entra SCIM protocol to the Authentik instance.

and in Authentik, setting up the Kerberos Source Federation

sync is disabled in Kerberos since it is not supported, then entered the keytab

Modified the **default-authentication-identification** stage and added Kerberos source

The chrome/brave and firefox settings are complete as described.

then testing this on a domain joined pc and the user logged in is a synced user

```
PS C:\Users\user> klist purge

Current LogonId is 0:0x19ea18
Deleting all tickets:
Ticket(s) purged!
PS C:\Users\user> klist get HTTP/authentik.domain.com

Current LogonId is 0:0x19ea18
A ticket to HTTP/authentik.domain.com has been retrieved successfully.

Cached Tickets: (2)

#0> Client: user @ DOMAIN.COM
Server: krbtgt/DOMAIN.COM @ DOMAIN.COM
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40810000 -> forwardable renewable name_canonicalize
Start Time: 3/7/2026 23:30:13 (local)
End Time: 3/8/2026 9:30:13 (local)
Renew Time: 3/14/2026 23:30:13 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0x1 -> PRIMARY
Kdc Called: DC2.domain.com

#1> Client: user @ DOMAIN.COM
Server: HTTP/authentik.domain.com @ DOMAIN.COM
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40810000 -> forwardable renewable name_canonicalize
Start Time: 3/7/2026 23:30:13 (local)
End Time: 3/8/2026 9:30:13 (local)
Renew Time: 3/14/2026 23:30:13 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0
Kdc Called: DC2.domain.com
```

I see that the ticket is issued with the correct address, domain and encryption

then testing it with curl

```
PS C:\Users\user> curl.exe -v --negotiate -u : https://authentik.domain.com/source/kerberos/ad-kerberos/
* Host authentik.domain.com:443 was resolved.
* IPv6: (none)
* IPv4: 172.31.255.20
* Trying 172.31.255.20:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Established connection to authentik.domain.com (172.31.255.20 port 443) from 192.168.100.40 port 61603
* using HTTP/1.x
* Server auth using Negotiate with user ''
> GET /source/kerberos/ad-kerberos/ HTTP/1.1
> Host: authentik.domain.com
> Authorization: Negotiate YIIfghhdcxcgedrtgjjjiiihkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHgYKKwYBBAGCNwICCqKCB6gEggekYIIHoAYJKoZIhvcSAQICAQBuggePMIIHi6ADAgEFoQMCAQ6iBwMFACAAAACjggWMYYIFiDCCBYSgAwIBBaERGw9LQVJHSUNJT0dMerwtr233qoAMCAQKhIzAhGwRIVFRQGxlhdXRoZWwerdsdcss3reVSWApnIg06dbzmClGGXVdIiDfXoZCRFrVxYEg+j0eQqXz/TETA6WRx84xvdb4i4rLrdGwsZX6RsmlqW5T2ZbBTMahXTRh6nXC7qTa+LPRYvWHxlVvJrEirfFHLYognXXBD7TpLKdUMkchNMFAr+UNGQcd+YFCyGhUWKJwvREUgE/kpPmFekQGPn/yHaArLSRtVZtsIM4S6zUhLQoAChc8ZU2ws8LkhK455pAlf0/vLAk7qTXTMcblD5ZQX9EZ4abR8fZ4djfKZ769iAk5DMGa3c6wS8pEXX5cmoFDu2pY6jDmcjQeQHuszva4lRtkSnfHEopC1pUd3lFKtxJObNUImGo4qVTW9xd4Ar1ekLQaTGuWkcdy9KdXk3mjjV10vJ9TCboyrLBNbj1wR0bx/Gjoujpo3y3UXXbvk3dstEu7X5I4asdf213y4k2UPj4x4RMnApb+ZlfipYh7XkAj/TwuUCjmqotwPiC9sjfUmiQzNhi/8LfOULEoKoTyb2PvBv47JrSXUFyIGvcairtNo6nTO7FcNG/iVt4EUDKZFvmXMG/KtNJdbTXiUlvzYy/m2etc/oHK+kIgH1ULXszK5EcRi8yq9xioZA12VDZZ7abOZ2k2fpwa2asYDup5stKzdtLzYHyMtIGDi4/lT8kZvzL75c6I9Fzm7NIGn8q8YYAn/jKcte6U4pJtNdbIqkJDANm3fqsGNNehywVi9JHuOjnH2MuSo1weQAeJ96PK57ybdmBKtgqh6Dakx8sD2tDV8/KOagOFLny6gq81BPcA/JZ92PrrbnnGY4ozgezNPXo9a4E6VDPO8SKVMk4JssBaKPnJg9D4CuO5K79VLsp/jlx5TQzemQiQTarYeq8WQQ2Tov+uFdHaX3I0DcLWPG/EfB9VC3iqDJrC0/cRrDY0Ja8dyrOiUFZ59lUj6AdpEaJiwdowjDDw8urbAfzP9ttujIenOhTXyfgf432sdfsdfs223yuıktrddcvha8x5awLZg1DeRuP5Rm9VRZ9uga5Hp8iTMRirLHnhCKSYLxY6U0d2AzzRkDETQb/47LZMzEIehQssYCi4kUoIVdzu+fyE7witUY4umgG18MJT3v6fVJDZFOriW73tbSRnPXsnddHYOGNzW1JcEtQC9ms5kzHPQiONy/O572oANVssmVoA0OV1q0FQVOxAY6rmMliMiAcEkegU5yD3d4ED1WKOQOUaY+mnDQBEwvkcTXOUpGkVaV02vTDd2snUrKxooTUDV61Rr9HDVoVftC5usRj77p4XG38A5/lfOXZuv7IYiXSPqSyqWILcJS5uvu14wlcS2mYGC7UQ0ozuVLVNKrGttEAc3Pdnsg5+TyWo5Jm92SrVuaciWSOoDVNZUgnwxlgEA4NvLxu1IodACauOvUW4yLf/W8rn+nJI84BkP5pdvD5yyljUeJ7ap/plQjCFUXHddfwewerwKKccXniBj1Evq+emwj06X1fYfEBVrkDzFgMDI3CZ7uUaqz6uW7cUk5OnAKSr/fztwTG66lCnBNEHtd/QpyWlOkv6Lx3VqKIsDdJt1QkeyoG/8U46jjdG4FUVF+05Vci7aI4IcJyeTK3kJjhrGCfNp+U2wZKy7/pfleEjsGHc5eKfkvrOi41itfy6zO52ayXgSBwRbCNUsK3vm9IMdqBDKENQG7TYsKC/nKSCAeQwggHgoAMCARKiggHXBIIB038uH8pveSvo7srfG93+i9ihNLCfJsWTqHLPJFv3BAA00beT4qi/XSPel/6/BoLj7S0YW90cbsplt+FpV2pQnUxrrLj75SVlUF4vVeoORgpe8eAc36HubXCvH+jUZ6nqUfLl+qxtQspGz8BH/BLJ705GDB7FJTdGZCOsEVsYCDA/COk/tvRavyrkAN/KZXeNKo5o0v0ZaoB7zg4C73Kv0aWWL5gkDPbVKTPHxqorxD1Sm6l4dhCqOVDQiZeoVW0Q5NCOi2ez73+vjNpWs7DdsAE4Ogw45ihFCghAwLtUBv72O1pItS28Vz7IbbuYS/sUDqplUsKaQZFsSYdJoA/2Ahfpjlk1zy9ssNU1SWyrTzhhcpDFTjSvVuXHPV5MOlGP9hPek8wRY89YAOUyumlr/9fbAl4YRE0I7lOIcSYthnJub1jdrqbX/kDPBdOq/wYliG/tozynJAaQ8FCUVAdNrq4Y0J/N+iGkWoDQg1ANWH6hny4E6qYKRfFXt28Njs9ozMB6+aA2t4GhlYuppdk7+P+Ml8IrzzSxLuhIoYi4/Y9CDh2V8Nz0SHQ8lJ4X93AosGmZUB3ZYFvixjosAPhJRWXLyDsKh2A92wH2m6RgVO7KK6TO
> User-Agent: curl/8.16.0
> Accept: */*
>
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 302 Found
< content-language: en
< content-length: 0
< content-type: text/html; charset=utf-8
< date: Sat, 07 Mar 2026 20:33:02 GMT
< location: /source/kerberos/ad-kerberos/?state=eziw58juU45UMu2Y

then error

same is true for firefox but it is not prompting for username and password.

Inspecting the requests in firefox

### How to reproduce

1. Steps explained above

### Expected behavior

Should just login

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.2.1

### Relevant log output

```shell

```