Kerberos single sign-on for .NET MAUI apps on Android through
Hypergate Authenticator. This library binds the
Hypergate SDK (com.hypergate:sdk on Maven
Central) so your app can authenticate against Kerberos-protected services without passwords or NTLM.
If you are planning a migration away from NTLM, start with the blog post Moving Your Android App off NTLM: Kerberos SSO with the Hypergate SDK. It covers the full integration story that this library implements for .NET MAUI.
Using Cordova, Capacitor, React Native or Flutter instead? See cordova-plugin-hypergate, capacitor-plugin-hypergate, react-native-hypergate and hypergate_flutter.
Hypergate Authenticator holds the user's Kerberos credentials (TGT) on the device. Your app never sees a password: it asks Hypergate for a SPNEGO/Negotiate token for a given service principal (SPN) and attaches it to the request.
The library targets net10.0-android only, since Hypergate itself is Android only.
- .NET 10 with the
android(ormaui-android) workload - A device managed by an MDM/EMM/UEM (supported EMMs) with Hypergate Authenticator deployed
dotnet add package Hypergate.MauiConfigure these managed configurations (app restrictions) in your MDM/EMM/UEM:
| Managed configuration | Value |
|---|---|
| Account type for HTTP Negotiate authentication | ch.papers.hypergate |
| Authentication server allowlist | * or an explicit list of domains allowed to request tokens |
In addition, your app's package name must be on the discoverability list in the Hypergate Authenticator managed configuration, otherwise token requests fail with error 101.
using Hypergate.Maui;
var activity = Platform.CurrentActivity!;
var token = await HypergateClient.GetTokenAsync(activity, "HTTP@securedbackend.com");
// attach to your request:
// request.Headers.Authorization = new AuthenticationHeaderValue("Negotiate", token);Do not cache the token. Request a fresh one for every API call, because a cached token may
have expired between app start and the actual request. The recommended pattern is a
DelegatingHandler on your HttpClient that fetches a token per request.
| Param | Description |
|---|---|
activity |
The current Android activity, e.g. Platform.CurrentActivity |
servicePrincipal |
SPN of the target service, e.g. HTTP@securedbackend.com |
Returns the raw Negotiate token. Throws a HypergateTokenException when Hypergate is not in
possession of a valid TGT, the device is not managed, or the app is not on the discoverability
list.
- Error 101 ("no accounts found"): the app's package name is missing from the discoverability list, or the device has no Hypergate account at all.
- Token issued but the backend returns 401: verify the SPN matches the backend's service principal and that the account has AES key material (see Kerberos RC4 removal).
A runnable .NET MAUI example lives in samples/HypergateMauiSample/:
cd samples/HypergateMauiSample
dotnet build -t:Run -f net10.0-androidMIT, see LICENSE. Questions go to support@hypergate.com.