Daniel Kouril's patch that adds HTTP negotiation support to libcurl was

                                  Changelog

Daniel (10 June)

- Daniel Kouril added HTTP Negotiate authentication support, as defined in the

  IETF draft draft-brezak-spnego-http-04.txt. In use already by various

  Microsoft web applications. CURLOPT_HTTPNEGOTIATE and --negotiate are the

  new family members.

- A missing ending bracket (']') while doing URL globbing could lead to a

  segfault. While fixing this, I also introduced better error reporting in the

  globbing code. (All this is application code outside libcurl.)

  AC_MSG_RESULT(no)

fi

dnl **********************************************************************

dnl Check for GSS-API libraries

dnl **********************************************************************

AC_ARG_WITH(gssapi-includes,

  AC_HELP_STRING([--with-gssapi-includes=DIR],

                 [Specify location of GSSAPI header]),

  [ GSSAPI_INCS="-I$withval" 

    want_gss="yes" ]

)

AC_ARG_WITH(gssapi-libs,

  AC_HELP_STRING([--with-gssapi-libs=DIR],

  		 [Specify location of GSSAPI libs]),

  [ GSSAPI_LIBS="-L$withval -lgssapi"

    want_gss="yes" ]

)

AC_ARG_WITH(gssapi,

  AC_HELP_STRING([--with-gssapi=DIR],

                 [Where to look for GSSAPI]),

  [ GSSAPI_ROOT="$withval"

    want_gss="yes" ]

)

AC_MSG_CHECKING([if GSSAPI support is requested])

if test x"$want_gss" = xyes; then

  if test -z "$GSSAPI_INCS"; then

     if test -f "$GSSAPI_ROOT/bin/krb5-config"; then

        gss_cppflags=`$GSSAPI_ROOT/bin/krb5-config --cflags gssapi`

	CPPFLAGS="$CPPFLAGS $gss_cppflags"

     else

        CPPFLAGS="$GSSAPI_ROOT/include"

     fi

  else

     CPPFLAGS="$CPPFLAGS $GSSAPI_INCS"

  fi

  if test -z "$GSSAPI_LIB_DIR"; then

     if test -f "$GSSAPI_ROOT/bin/krb5-config"; then

        gss_ldflags=`$GSSAPI_ROOT/bin/krb5-config --libs gssapi`

	LDFLAGS="$LDFLAGS $gss_ldflags"

     else

        LDFLAGS="$LDFLAGS $GSSAPI_ROOT/lib -lgssapi"

     fi

  else

     LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"

  fi

  AC_MSG_RESULT(yes)

  AC_DEFINE(GSSAPI, 1, [if you have the gssapi libraries])

else

  AC_MSG_RESULT(no)

fi

dnl Detect the pkg-config tool, as it may have extra info about the

dnl openssl installation we can use. I *believe* this is what we are

dnl expected to do on really recent Redhat Linux hosts.

sent over the wire in clear text. Use this in combination with the normal

-u/--user option to set user name and password.  (Option added in curl 7.10.6)

If this option is used several times,  each occurrence will toggle this on/off.

.IP "--negotiate"

(HTTP) Enables Negotiate authentication. The Negotiate method was designed by

Microsoft and is used in their web aplications. It is primarily meant as a

support for Kerberos5 authentication but may be also used along with another

authentication methods. For more information see IETF draft

draft-brezak-spnego-http-04.txt.

If this option is used several times,  each occurrence will toggle this on/off.

.IP "--disable-epsv"

(FTP) Tell curl to disable the use of the EPSV command when doing passive FTP

and with smaller chunks. This is just treated as a request, not an order. You

cannot be guaranteed to actually get the given size. (Added in 7.10)

.PP

.SH NAMES and PASSWORDS OPTIONS

.SH NAMES and PASSWORDS OPTIONS (Authentication)

.TP 0.4i

.B CURLOPT_NETRC

This parameter controls the preference of libcurl between using user names and

When using HTTP and CURLOPT_FOLLOWLOCATION, libcurl might perform several

requests to possibly different hosts. libcurl will only send this user and

password information to hosts using the initial host name, so if libcurl

follows locations to other hosts it will not send the user and password to

those. This is enforced to prevent accidental information leakage.

password information to hosts using the initial host name (unless

CURLOPT_UNRESTRICTED_AUTH is set), so if libcurl follows locations to other

hosts it will not send the user and password to those. This is enforced to

prevent accidental information leakage.

.TP

.B CURLOPT_PROXYUSERPWD

Pass a char * as parameter, which should be [user name]:[password] to use for

the connection to the HTTP proxy. If the password is left out, you will be

prompted for it. \fICURLOPT_PASSWDFUNCTION\fP can be used to set your own

prompt function.

.TP

.B CURLOPT_HTTPDIGEST

Pass a long set to a non-zero value to enable HTTP Digest authentication.

Digest authentication is defined in RFC2617 and is a somewhat more secure way

to do user+password checking over public networks than the regular

old-fashioned Basic authentication. By default, libcurl uses Basic. Set name

and password with the CURLOPT_USERPWD option. (Added in 7.10.6)

.TP

.B CURLOPT_HTTPNEGOTIATE

Pass a long set to a non-zero value to enable HTTP Negotiate authentication.

The Negotiate method was designed by Microsoft and is used in their web

aplications. It is primarily meant as a support for Kerberos5 authentication

but may be also used along with another authentication methods. For more

information see IETF draft draft-brezak-spnego-http-04.txt.  Set name and

password with the CURLOPT_USERPWD option. (Added in 7.10.6)

.PP

.SH HTTP OPTIONS

.TP 0.4i

     You should use this in combination with CURLOPT_USERPWD. */

  CINIT(HTTPDIGEST, LONG, 107),

  /* Set this to a non-zero value to enable HTTP Negotiate Authentication.

     You should use this in combination with CURLOPT_USERPWD. */

  CINIT(HTTPNEGOTIATE, LONG, 108),

  CURLOPT_LASTENTRY /* the last unused */

} CURLoption;