HTTP/SPNEGO uses JGSS-API directly to create tokens and communicate with remote HTTP server, which means user needs to specify -Djavax.security.auth.useSubjectCredsOnly=false to make it work. This may be OK for a standalone application, but very difficult to configure in Java Plug-in, which is the case when an applet resides on a HTTP server and protected by SPNEGO.