While modern authentication protocols like OAuth 2.0 and mTLS are the de-facto standard these days, Kerberos-based (GSS-API/SPNEGO) authentication is still commonly used within many enterprise organizations. The challenge is that many modern applications and development frameworks do not natively support Kerberos authentication or provide libraries that make integration straightforward, which can make supporting these environments difficult.
The VCF Download Tool (VCFDT) is one such example. While it supports connecting to an HTTPS proxy with basic authentication, it does not natively support Kerberos authentication. This is where Px can help by acting as an intermediary running locally on the same system as VCFDT, enabling it to connect through a Kerberos-authenticated HTTPS proxy.
Here is a quick visual (thanks to ChatGPT) that demonstrates the connection flow from the client system (client.vcf.lab) running VCFDT, which uses an authenticated keytab from the Kerberos server (kdc.vcf.lab) to authenticate with the proxy server (proxy.vcf.lab). Once authenticated, VCFDT can connect to broadcom.com through the proxy to download the required software binaries and metadata.
