How I can generate correct SPNEGO token from existing kerberos token using pyspnego?

First of all, you are confusing tickets and tokens.

• Tickets are the reusable credential shown in klist and stored in gssapi.Credentials. A "ticket" is a Kerberos-specific concept.

  Tokens are the one-time credential returned from ctx.step() and sent in HTTP Authorization headers. A "token" can be produced by any mechanism (Kerberos, SPNEGO, NTLM, and whatnot).

• Tickets do not contain tokens – it is the opposite; a mechanism token will contain a Kerberos ticket (plus a one-time authenticator).

• Therefore, calling b64encode(token) does not create a ticket; the result is just a b64_token, not a b64_ticket.

Second, your mixing of gssapi.SecurityContext and spnego.client seems backwards.

• You're configuring the SecurityContext with usage "initiate", therefore its tokens are meant to be sent to a server (acceptor) – it makes no sense to give them to a spnego.client which is a second initiator and expects to be given a token received from a server.

  Basically, initiator=client and acceptor=server. Two initiators cannot talk to each other; spnego.client will not convert a client token to a different type of client token.

• Overall, it doesn't make sense to use both gssapi.SecurityContext and spnego.client (except in loopback tests) – either use one or the other.

  The advantage of spnego.client is that it is cross-platform (automatically using SSPI on Windows or GSSAPI on Linux). But in your case, you are already hard-depending on the gssapi module, therefore it's more appropriate to directly use gssapi.SecurityContext for the final token too.

Finally, the reason you're not getting SPNEGO is because your code did not ask for SPNEGO. In one case your code explicitly asks for mech=MechType.kerberos, and in another case your code doesn't specify any mechanism, therefore GSSAPI defaults to Kerberos again.

• SPNEGO is not a native part of Kerberos; it is a Microsoft extension. So although SPNEGO may be the default for Microsoft SSPI, plain Kerberos is the default for standard GSSAPI.

• The MIT Krb5 implementation of GSSAPI does support SPNEGO, but you have to explicitly request it like this:

  spnego_oid = gssapi.Mechanism.from_sasl_name("SPNEGO")
  # -or-
  # spnego_oid = gssapi.Mechanism.from_int_seq("1.3.6.1.5.5.2")
  # -or-
  # spnego_oid = gssapi.OID.from_int_seq("1.3.6.1.5.5.2")
  
  ctx = gssapi.SecurityContext(..., mech=spnego_oid, ...)
  

• If you're using requests for the actual HTTP request, I'd recommend using the requests_gssapi module to handle the final bits (it will automatically create a context and obtain a token for each HTTP request):

  spnego_oid = gssapi.Mechanism.from_sasl_name("SPNEGO")
  
  auth_handler = requests_gssapi.HTTPSPNEGOAuth(mech=spnego_oid,
                                                creds=impersonated_creds,
                                                opportunistic_auth=True)
  
  http_client = requests.Session(auth=auth_handler)
  

  Recent versions of requests_gssapi already default to requesting SPNEGO, though in older versions it was necessary to specify it manually.

  The same recommendation goes for httpx_gssapi if you use httpx.

One additional note is that Kerberos principals should be treated as if they're case-sensitive (both the service name and the host name).

• Active Directory domain controllers are case-insensitive and treat "HOST/foo" identically to "host/FOO" and so on, but that doesn't apply to other Kerberos implementations, so it would be best practice to use the standard spelling of service names.

• HTTP is always upper-case, but host should be lower-case. (Of course, if your keytab contains "HOST/", then you might have no choice but to use "HOST/" yourself, but that would mean the keytab was generated incorrectly.)

• Most other "generic" Kerberos service names such as imap, smtp, cifs are lower-case as well (HTTP being the exception, not the rule).

• Realm names are always upper-case (REGION.INTRA.NET is correct).

  Domain names are usually lower-case ('HTTP/sap3.' + realm.lower() is correct).