A DESCRIPTION OF THE REQUEST :
Microsoft has a new SPNEGO scheme NEGOEX
see

http://msdn.microsoft.com/en-us/library/ff468736.aspx
http://tools.ietf.org/html/draft-zhu-negoex
http://blogs.msdn.com/b/openspecification/archive/2011/07/01/a-quick-look-at-the-new-negotiation-mechanism-negoex-used-with-spnego-in-windows-7.aspx

JUSTIFICATION :
Newer version of Windows are sending NEGOEX before fallback back to the normal SPNEGO

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Expect it to work.
ACTUAL -
it doesn't work, with error: "GSSHeader did not find the right tag"


CUSTOMER SUBMITTED WORKAROUND :

diff --git a/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java b/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
--- a/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
+++ b/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
@@ -523,12 +523,8 @@
                     valid = false;
                 }
 
-                // get the mechanism token
-                byte[] mechToken = initToken.getMechToken();
-                if (mechToken == null) {
-                    throw new GSSException(GSSException.FAILURE, -1,
-                            "mechToken is missing");
-                }
+                // get the mechanism token (OPTIONAL)
+                byte[] mechToken = null;
 
                 /*
                  * Select the best match between the list of mechs
@@ -543,9 +539,15 @@
                 }
                 // save the desired mechanism
                 internal_mech = mech_wanted;
+                
+                byte[] accept_token = null;
+                if (mechList[0] == mech_wanted) {
+                    // mechToken is only for the first mech.
+                    mechToken = initToken.getMechToken();
+                    accept_token = GSS_acceptSecContext(mechToken);
+                }
 
                 // get the token for mechanism
-                byte[] accept_token = GSS_acceptSecContext(mechToken);
 
                 // verify MIC
                 if (!GSSUtil.useMSInterop() && valid) {
@@ -595,9 +597,24 @@
 
             } else if (state == STATE_IN_PROCESS) {
                 // read the token
-                byte[] client_token = new byte[is.available()];
-                SpNegoToken.readFully(is, client_token);
-                byte[] accept_token = GSS_acceptSecContext(client_token);
+                byte[] token = new byte[is.available()];
+                SpNegoToken.readFully(is, token);
+                if (DEBUG) {
+                    System.out.println("SpNegoContext.acceptSecContext: " +
+                                        "receiving token = " +
+                                        SpNegoToken.getHexBytes(token));
+                }
+
+                // read the SPNEGO token
+                // token will be validated when parsing
+                NegTokenTarg respToken = new NegTokenTarg(token);
+
+                if (DEBUG) {
+                    System.out.println("SpNegoContext.acceptSecContext: " +
+                                "received token of type = " +
+                                SpNegoToken.getTokenName(respToken.getType()));
+                }
+                byte[] accept_token = GSS_acceptSecContext(respToken.getResponseToken());
                 if (accept_token == null) {
                     valid = false;
                 }