Therefore, it is best for use in intranets where all the clients are within a single domain. Integrated Windows Authentication works with most modern web browsers, but does not work over some HTTP proxy servers.

Third party utilities have extended the Integrated Windows Authentication paradigm to UNIX, Linux and Mac systems. IWA uses SPNEGO to allow initiators and acceptors to negotiate either Kerberos or NTLMSSP. Similarly, if Kerberos authentication is attempted, yet it fails, then NTLMSSP is attempted. Otherwise NTLMSSP authentication is attempted. Intranet sites settings in Internet Explorer), the Kerberos 5 protocol will be attempted. If the Kerberos provider is functional and a Kerberos ticket can be obtained for the target, and any associated settings permit Kerberos authentication to occur (e.g. within the Directory Security tab of the IIS site properties dialog) this implies that underlying security mechanisms should be used in a preferential order. When IWA is selected as an option of a program (e.g. Integrated Windows Authentication itself is not a standard or an authentication protocol. If the authentication exchange initially fails to identify the user, the web browser will prompt the user for a Windows user account user name and password. The current Windows user information on the client computer is supplied by the web browser through a cryptographic exchange involving hashing with the Web server. Unlike Basic Authentication or Digest Authentication, initially, it does not prompt users for a user name and password. Integrated Windows Authentication uses the security features of Windows clients and servers. Further information: SPNEGO, Kerberos (protocol), NTLMSSP, NTLM, SSPI, and GSSAPI

Update java linux