Skip to content

Update Kerberos/NTLM docs #2299

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjcheetham merged 2 commits into from
Mar 23, 2026
+36 −0
Merged

Update Kerberos/NTLM docs #2299

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e8533ed
docs: add a section about NTLM-over-SPNEGO
mjcheetham Mar 23, 2026
5687c1c
docs: add workaround for Kerberos-off-by-default bug
mjcheetham Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions docs/ntlm-kerberos.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,30 @@ server to agree on which authentication protocol to use (Kerberos or NTLM) based
on their capabilities. Typically Kerberos is preferred if both the client and
server support it, with NTLM acting as a fallback.

#### NTLM-over-SPNEGO

> [!CAUTION]
> When using SPNEGO negotiation if either the client or server does not support
> Kerberos, or if there is an issue with Kerberos authentication, _NTLM may be
> selected as a fallback authentication protocol_.
>
> **This can expose you to all the security risks associated with NTLM.**
Currently the only way to prevent NTLM from being used as a fallback when SPNEGO
negotiation is in use on Windows is to set the following registry key on your
client system to the value `2` (type `DWORD`) to disable NTLM support
system-wide:

```text
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic
```

> [!WARNING]
> Disabling NTLM support system-wide can have unintended consequences.
>
> NTLM is still often used in various legacy applications and services, and
> disabling it may cause authentication failures in those applications.
## Built-in Support in Git

Git provides built-in support for NTLM and Kerberos authentication through the
Expand All @@ -61,6 +85,18 @@ On Windows, Git can use the native Windows [SSPI][sspi-wiki] (Security Support
Provider Interface) to perform NTLM and Kerberos authentication. This allows Git
to integrate seamlessly with the Windows authentication infrastructure.

> [!IMPORTANT]
> Kerberos authentication is not enabled by default in Git due to a known bug.
>
> To workaround this bug and enable Kerberos authentication, you must set the
> `http.<url>.emptyAuth` configuration option to `true` for your remote URL.
>
> For example:
>
> ```shell
> git config --global http.https://example.com.emptyAuth true
> ```
> [!NOTE]
> As of Git for Windows version 2.53.0.2, **NTLM support is disabled by
> default**.
Expand Down
Loading