SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows
RFC 4559

[Ballot comment]
Are HTTP Auth extensions something that should be done in an RFC Ed document?
No objection to this document, but we've done them in the past with significant
review and I thought we might have some policy about such a major HTTP header

Checked with Sam.  His concerns were related to the way this works (or doesn't work well) with proxies.  There's text in the Security Considerations section that describes the issues, though, so I think the topic is covered well enough for an Informational document.

AD evaluation comments:

The title should probably include "Microsoft" before "Windows": "Kerberos-based HTTP Authentication in Microsoft Windows".

The method described appears to be mechanically consistent with the authentication schemes and models described in RFCs 2616 and 2617.

Sam Hartman has also looked at the document.  His analysis: "There are no dragons on the Kerberos side.  It's well understood there and everyone is familiar with how it works."

He did have some concerns about how this fits with the http authentication model, though.  I'm checking with him on that.