title: SPNEGO (kerberos token generation/validation) for SSO using Python
body: <p>I'm attempting to implement a simple Single Sign On scenario where some of the participating servers will be windows (IIS) boxes. It looks like SPNEGO is a reasonable path for this.</p>
  
  <p>Here's the scenario:</p>
  
  <ul>
  <li>User logs in to my SSO service using his username and password. I authenticate him using some mechanism.</li>
  <li>At some later time the user wants to access App A.
  
  <ul>
  <li>The user's request for App A is intercepted by the SSO service. The SSO service uses SPNEGO to log the user in to App A:
  
  <ul>
  <li>The SSO service hits the App A web page, gets a "WWW-Authenticate: Negotiate" response</li>
  <li>The SSO service generates a "Authorization: Negotiate xxx" response on behalf of the user, responds to App A. The user is now logged in to App A.</li>
  </ul></li>
  <li>The SSO service intercepts subsequent user requests for App A, inserting the Authorization header into them before passing them on to App A.</li>
  </ul></li>
  </ul>
  
  <p>Does that sound right? </p>
  
  <p>I need two things (at least that I can think of now):</p>
  
  <ul>
  <li>the ability to generate the "Authorization: Negotiate xxx" token on behalf of the user, preferably using Python</li>
  <li>the ability to validate "Authorization: Negotiate xxx" headers in Python (for a later part of the project)</li>
  </ul>