如何用Curl实现NTLM认证并解决SPNEGO协商机制缺失问题？

Hey there! Let's tackle your two questions step by step—first, how to use curl with NTLM authentication to get XML responses, then how to fix that "SPNEGO cannot find mechanisms to negotiate" error you're running into.

Most modern curl builds support NTLM out of the box, but first double-check yours by running curl --version—look for "NTLM" in the list of supported protocols/auth methods.

Here's how to structure your command:

• Basic NTLM command: Use the --ntlm flag, provide your domain\username and password with -u, and set an Accept header to tell the server you want XML:

  curl --ntlm -u "DOMAIN\your-username:your-password" -H "Accept: application/xml" https://your-target-server.com/api/endpoint
  

• Force NTLMv2 (recommended): Many servers require NTLMv2 for security. Replace --ntlm with --ntlmv2:

  curl --ntlmv2 -u "DOMAIN\your-username:your-password" -H "Accept: application/xml" https://your-target-server.com/api/endpoint
  

• Save XML to a file: Add the -o flag to write the response directly to a file instead of printing it to the terminal:

  curl --ntlmv2 -u "DOMAIN\your-username:your-password" -H "Accept: application/xml" -o output.xml https://your-target-server.com/api/endpoint
  

• Pro tip: If your password has special characters (like @, &, or !), wrap the entire -u value in single quotes to avoid parsing issues, or escape the special characters with a backslash (e.g., \@).

This error pops up when curl tries to use SPNEGO (a protocol that often uses Kerberos) for authentication, but your system doesn't have the right tools/config to support it—and chances are, the server you're targeting actually expects NTLM instead. Here's how to fix it:

• Force curl to use NTLM: The simplest fix is to explicitly add --ntlm or --ntlmv2 to your command, like we did above. This tells curl to skip SPNEGO negotiation entirely and go straight to NTLM, which should resolve the error.
• Check for outdated curl: Older versions of curl might have issues with automatic auth negotiation. If forcing NTLM doesn't work, upgrade curl to the latest stable release—this often fixes compatibility quirks.
• Disable SPNEGO (if needed): In rare cases, your system might have SPNEGO enabled by default. You can disable it for curl by setting the CURL_HTTP_AUTH environment variable to ntlm before running the command:

  export CURL_HTTP_AUTH=ntlm
  curl -u "DOMAIN\your-username:your-password" -H "Accept: application/xml" https://your-target-server.com/api/endpoint
  

内容的提问来源于stack exchange，提问作者user3199063