diff -up evolution-ews-3.12.4/src/addressbook/e-book-backend-ews.c.gssapi-fix evolution-ews-3.12.4/src/addressbook/e-book-backend-ews.c
--- evolution-ews-3.12.4/src/addressbook/e-book-backend-ews.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/addressbook/e-book-backend-ews.c	2014-07-18 17:09:57.496421505 -0700
@@ -43,6 +43,7 @@
 #include "server/e-ews-item-change.h"
 #include "server/e-ews-message.h"
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 #include "server/e-ews-item.h"
 #include "server/e-source-ews-folder.h"
 
@@ -4012,6 +4013,18 @@ e_book_backend_ews_dispose (GObject *obj
 	G_OBJECT_CLASS (e_book_backend_ews_parent_class)->dispose (object);
 }
 
+static gboolean
+book_backend_ews_get_without_password (ESourceAuthenticator *authenticator)
+{
+	EBookBackendEws *backend;
+	CamelEwsSettings *ews_settings;
+
+	backend = E_BOOK_BACKEND_EWS (authenticator);
+	ews_settings = book_backend_ews_get_collection_settings (backend);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 book_backend_ews_try_password_sync (ESourceAuthenticator *authenticator,
                                     const GString *password,
@@ -4097,6 +4110,8 @@ e_book_backend_ews_class_init (EBookBack
 static void
 e_book_backend_ews_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		book_backend_ews_get_without_password;
 	iface->try_password_sync = book_backend_ews_try_password_sync;
 }
 
diff -up evolution-ews-3.12.4/src/calendar/e-cal-backend-ews.c.gssapi-fix evolution-ews-3.12.4/src/calendar/e-cal-backend-ews.c
--- evolution-ews-3.12.4/src/calendar/e-cal-backend-ews.c.gssapi-fix	2014-07-03 09:31:39.000000000 -0700
+++ evolution-ews-3.12.4/src/calendar/e-cal-backend-ews.c	2014-07-18 17:09:57.496421505 -0700
@@ -43,6 +43,7 @@
 #include <calendar/gui/itip-utils.h>
 
 #include "server/e-source-ews-folder.h"
+#include "server/e-ews-connection-utils.h"
 
 #include "utils/ews-camel-common.h"
 
@@ -4204,6 +4205,18 @@ e_cal_backend_ews_finalize (GObject *obj
 	G_OBJECT_CLASS (e_cal_backend_ews_parent_class)->finalize (object);
 }
 
+static gboolean
+cal_backend_ews_get_without_password (ESourceAuthenticator *authenticator)
+{
+	ECalBackendEws *backend;
+	CamelEwsSettings *ews_settings;
+
+	backend = E_CAL_BACKEND_EWS (authenticator);
+	ews_settings = cal_backend_ews_get_collection_settings (backend);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 cal_backend_ews_try_password_sync (ESourceAuthenticator *authenticator,
                                    const GString *password,
@@ -4296,6 +4309,8 @@ e_cal_backend_ews_class_init (ECalBacken
 static void
 e_cal_backend_ews_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		cal_backend_ews_get_without_password;
 	iface->try_password_sync = cal_backend_ews_try_password_sync;
 }
 
diff -up evolution-ews-3.12.4/src/camel/camel-ews-store.c.gssapi-fix evolution-ews-3.12.4/src/camel/camel-ews-store.c
--- evolution-ews-3.12.4/src/camel/camel-ews-store.c.gssapi-fix	2014-06-12 12:52:28.000000000 -0700
+++ evolution-ews-3.12.4/src/camel/camel-ews-store.c	2014-07-18 17:09:57.497421478 -0700
@@ -1887,14 +1887,6 @@ ews_store_query_auth_types_sync (CamelSe
 
 	g_return_val_if_fail (CAMEL_IS_EWS_STORE (service), NULL);
 
-	if (!camel_offline_store_get_online (CAMEL_OFFLINE_STORE (service))) {
-		g_set_error (
-			error, CAMEL_SERVICE_ERROR,
-			CAMEL_SERVICE_ERROR_UNAVAILABLE,
-			_("You must be working online to complete this operation"));
-		return NULL;
-	}
-
 	settings = camel_service_ref_settings (service);
 	ews_settings = CAMEL_EWS_SETTINGS (settings);
 	hosturl = camel_ews_settings_dup_hosturl (ews_settings);
diff -up evolution-ews-3.12.4/src/configuration/e-ews-config-utils.c.gssapi-fix evolution-ews-3.12.4/src/configuration/e-ews-config-utils.c
--- evolution-ews-3.12.4/src/configuration/e-ews-config-utils.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/configuration/e-ews-config-utils.c	2014-07-18 17:09:57.498421450 -0700
@@ -36,6 +36,7 @@
 #include <shell/e-shell-window.h>
 
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 #include "server/e-source-ews-folder.h"
 
 #include "e-ews-edit-folder-permissions.h"
@@ -264,6 +265,13 @@ struct _EEwsConfigUtilsAuthenticatorClas
 	GObjectClass parent_class;
 };
 
+static gboolean
+ews_config_utils_authenticator_get_without_password (ESourceAuthenticator *auth)
+{
+	EEwsConfigUtilsAuthenticator *authenticator = (EEwsConfigUtilsAuthenticator *) auth;
+	return e_ews_connection_utils_get_without_password (authenticator->ews_settings);
+}
+
 static ESourceAuthenticationResult
 ews_config_utils_authenticator_try_password_sync (ESourceAuthenticator *auth,
                                                   const GString *password,
@@ -358,6 +366,8 @@ e_ews_config_utils_authenticator_class_i
 static void
 e_ews_config_utils_authenticator_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		ews_config_utils_authenticator_get_without_password;
 	iface->try_password_sync = ews_config_utils_authenticator_try_password_sync;
 }
 
diff -up evolution-ews-3.12.4/src/configuration/e-mail-config-ews-autodiscover.c.gssapi-fix evolution-ews-3.12.4/src/configuration/e-mail-config-ews-autodiscover.c
--- evolution-ews-3.12.4/src/configuration/e-mail-config-ews-autodiscover.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/configuration/e-mail-config-ews-autodiscover.c	2014-07-18 17:09:57.498421450 -0700
@@ -27,6 +27,7 @@
 #include <mail/e-mail-config-service-page.h>
 
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 
 #define E_MAIL_CONFIG_EWS_AUTODISCOVER_GET_PRIVATE(obj) \
 	(G_TYPE_INSTANCE_GET_PRIVATE \
@@ -246,6 +247,22 @@ mail_config_ews_autodiscover_clicked (Gt
 	mail_config_ews_autodiscover_run (autodiscover);
 }
 
+static gboolean
+mail_config_ews_autodiscover_get_without_password (ESourceAuthenticator *auth)
+{
+	EMailConfigEwsAutodiscover *autodiscover;
+	EMailConfigServiceBackend *backend;
+	CamelSettings *settings;
+	CamelEwsSettings *ews_settings;
+
+	autodiscover = E_MAIL_CONFIG_EWS_AUTODISCOVER (auth);
+	backend = e_mail_config_ews_autodiscover_get_backend (autodiscover);
+	settings = e_mail_config_service_backend_get_settings (backend);
+	ews_settings = CAMEL_EWS_SETTINGS (settings);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 mail_config_ews_autodiscover_try_password_sync (ESourceAuthenticator *auth,
                                                 const GString *password,
@@ -321,6 +338,8 @@ e_mail_config_ews_autodiscover_class_ini
 static void
 e_mail_config_ews_autodiscover_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		mail_config_ews_autodiscover_get_without_password;
 	iface->try_password_sync =
 		mail_config_ews_autodiscover_try_password_sync;
 }
diff -up evolution-ews-3.12.4/src/configuration/e-mail-config-ews-delegates-page.c.gssapi-fix evolution-ews-3.12.4/src/configuration/e-mail-config-ews-delegates-page.c
--- evolution-ews-3.12.4/src/configuration/e-mail-config-ews-delegates-page.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/configuration/e-mail-config-ews-delegates-page.c	2014-07-18 17:09:57.498421450 -0700
@@ -31,6 +31,7 @@
 
 #include "server/camel-ews-settings.h"
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 #include "server/e-ews-oof-settings.h"
 #include "camel/camel-ews-store.h"
 
@@ -1499,6 +1500,20 @@ sort_by_display_name_cb (gconstpointer a
 	return g_utf8_collate (aname, bname);
 }
 
+static gboolean
+mail_config_ews_delegates_page_get_without_password (ESourceAuthenticator *auth)
+{
+	EMailConfigEwsDelegatesPage *page;
+	CamelSettings *settings;
+	CamelEwsSettings *ews_settings;
+
+	page = E_MAIL_CONFIG_EWS_DELEGATES_PAGE (auth);
+	settings = mail_config_ews_delegates_page_get_settings (page);
+	ews_settings = CAMEL_EWS_SETTINGS (settings);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 mail_config_ews_delegates_page_try_password_sync (ESourceAuthenticator *auth,
                                                   const GString *password,
@@ -1636,6 +1651,8 @@ e_mail_config_ews_delegates_page_interfa
 static void
 e_mail_config_ews_delegates_page_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		mail_config_ews_delegates_page_get_without_password;
 	iface->try_password_sync = mail_config_ews_delegates_page_try_password_sync;
 }
 
diff -up evolution-ews-3.12.4/src/configuration/e-mail-config-ews-oal-combo-box.c.gssapi-fix evolution-ews-3.12.4/src/configuration/e-mail-config-ews-oal-combo-box.c
--- evolution-ews-3.12.4/src/configuration/e-mail-config-ews-oal-combo-box.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/configuration/e-mail-config-ews-oal-combo-box.c	2014-07-18 17:09:57.498421450 -0700
@@ -25,6 +25,7 @@
 #include <mail/e-mail-config-service-page.h>
 
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 
 #define E_MAIL_CONFIG_EWS_OAL_COMBO_BOX_GET_PRIVATE(obj) \
 	(G_TYPE_INSTANCE_GET_PRIVATE \
@@ -135,6 +136,23 @@ mail_config_ews_oal_combo_box_finalize (
 		finalize (object);
 }
 
+static gboolean
+mail_config_ews_oal_combo_box_get_without_password (ESourceAuthenticator *auth)
+{
+	EMailConfigEwsOalComboBox *combo_box;
+	EMailConfigServiceBackend *backend;
+	CamelSettings *settings;
+	CamelEwsSettings *ews_settings;
+
+	combo_box = E_MAIL_CONFIG_EWS_OAL_COMBO_BOX (auth);
+	backend = e_mail_config_ews_oal_combo_box_get_backend (combo_box);
+	settings = e_mail_config_service_backend_get_settings (backend);
+
+	ews_settings = CAMEL_EWS_SETTINGS (settings);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 mail_config_ews_oal_combo_box_try_password_sync (ESourceAuthenticator *auth,
                                                  const GString *password,
@@ -219,6 +237,8 @@ e_mail_config_ews_oal_combo_box_class_in
 static void
 e_mail_config_ews_oal_combo_box_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		mail_config_ews_oal_combo_box_get_without_password;
 	iface->try_password_sync =
 		mail_config_ews_oal_combo_box_try_password_sync;
 }
diff -up evolution-ews-3.12.4/src/configuration/e-mail-config-ews-ooo-page.c.gssapi-fix evolution-ews-3.12.4/src/configuration/e-mail-config-ews-ooo-page.c
--- evolution-ews-3.12.4/src/configuration/e-mail-config-ews-ooo-page.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/configuration/e-mail-config-ews-ooo-page.c	2014-07-18 17:09:57.498421450 -0700
@@ -32,6 +32,7 @@
 
 #include "server/camel-ews-settings.h"
 #include "server/e-ews-connection.h"
+#include "server/e-ews-connection-utils.h"
 #include "server/e-ews-oof-settings.h"
 
 #define E_MAIL_CONFIG_EWS_OOO_PAGE_GET_PRIVATE(obj) \
@@ -790,6 +791,20 @@ mail_config_ews_ooo_page_submit_finish (
 	return !g_simple_async_result_propagate_error (simple, error);
 }
 
+static gboolean
+mail_config_ews_ooo_page_get_without_password (ESourceAuthenticator *auth)
+{
+	EMailConfigEwsOooPage *page;
+	CamelSettings *settings;
+	CamelEwsSettings *ews_settings;
+
+	page = E_MAIL_CONFIG_EWS_OOO_PAGE (auth);
+	settings = mail_config_ews_ooo_page_get_settings (page);
+	ews_settings = CAMEL_EWS_SETTINGS (settings);
+
+	return e_ews_connection_utils_get_without_password (ews_settings);
+}
+
 static ESourceAuthenticationResult
 mail_config_ews_ooo_page_try_password_sync (ESourceAuthenticator *auth,
                                             const GString *password,
@@ -922,6 +937,8 @@ e_mail_config_ews_ooo_page_interface_ini
 static void
 e_mail_config_ews_ooo_page_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		mail_config_ews_ooo_page_get_without_password;
 	iface->try_password_sync =
 		mail_config_ews_ooo_page_try_password_sync;
 }
diff -up evolution-ews-3.12.4/src/server/camel-ews-settings.c.gssapi-fix evolution-ews-3.12.4/src/server/camel-ews-settings.c
--- evolution-ews-3.12.4/src/server/camel-ews-settings.c.gssapi-fix	2014-06-12 12:52:28.000000000 -0700
+++ evolution-ews-3.12.4/src/server/camel-ews-settings.c	2014-07-18 17:09:57.498421450 -0700
@@ -956,6 +956,8 @@ void
 camel_ews_settings_set_hosturl (CamelEwsSettings *settings,
                                 const gchar *hosturl)
 {
+	SoupURI *soup_uri = NULL;
+
 	g_return_if_fail (CAMEL_IS_EWS_SETTINGS (settings));
 
 	g_mutex_lock (&settings->priv->property_lock);
@@ -970,6 +972,23 @@ camel_ews_settings_set_hosturl (CamelEws
 
 	g_mutex_unlock (&settings->priv->property_lock);
 
+	if (hosturl != NULL)
+		soup_uri = soup_uri_new (hosturl);
+
+	if (soup_uri != NULL) {
+		const gchar *host = soup_uri_get_host (soup_uri);
+		int          port = soup_uri_get_port (soup_uri);
+
+		camel_network_settings_set_host (
+				CAMEL_NETWORK_SETTINGS (settings),
+				host);
+		camel_network_settings_set_port (
+				CAMEL_NETWORK_SETTINGS (settings),
+				port);
+
+		soup_uri_free (soup_uri);
+	}
+
 	g_object_notify (G_OBJECT (settings), "hosturl");
 }
 
diff -up evolution-ews-3.12.4/src/server/e-ews-connection.c.gssapi-fix evolution-ews-3.12.4/src/server/e-ews-connection.c
--- evolution-ews-3.12.4/src/server/e-ews-connection.c.gssapi-fix	2014-07-10 12:11:31.000000000 -0700
+++ evolution-ews-3.12.4/src/server/e-ews-connection.c	2014-07-18 17:11:02.144631778 -0700
@@ -46,6 +46,7 @@
 #include "e-ews-item-change.h"
 #include "e-ews-debug.h"
 #include "e-ews-notification.h"
+#include "soup-auth-negotiate.h"
 
 #define d(x) x
 
@@ -74,6 +75,10 @@ static void	ews_connection_authenticate
 						 SoupAuth *auth,
 						 gboolean retrying,
 						 gpointer data);
+static void
+ews_dump_raw_soup_request (SoupMessage *msg);
+static void
+ews_dump_raw_soup_response (SoupMessage *msg);
 
 /* Connection APIS */
 
@@ -170,6 +175,10 @@ struct _EwsUrls {
 /* Forward Declarations */
 static void	e_ews_connection_authenticator_init
 				(ESourceAuthenticatorInterface *iface);
+static GObject * ews_connection_constructor 
+				(GType                  gtype,
+				 guint                  n_properties,
+				 GObjectConstructParam  *properties);
 
 G_DEFINE_TYPE_WITH_CODE (
 	EEwsConnection,
@@ -488,6 +497,19 @@ typedef struct _EwsScheduleData
 	gpointer queue_user_data;
 } EwsScheduleData;
 
+static gboolean
+ews_connection_get_without_password (ESourceAuthenticator *authenticator)
+{
+	gboolean result;
+	EEwsConnection *cnc = E_EWS_CONNECTION (authenticator);
+	CamelEwsSettings *ews_settings = e_ews_connection_ref_settings (cnc);
+
+	result = e_ews_connection_utils_get_without_password (ews_settings);
+
+	g_object_unref (ews_settings);
+	return result;
+}
+
 /* this is run in priv->soup_thread */
 static gboolean
 ews_connection_scheduled_cb (gpointer user_data)
@@ -498,6 +520,8 @@ ews_connection_scheduled_cb (gpointer us
 
 	switch (sd->op) {
 	case EWS_SCHEDULE_OP_QUEUE_MESSAGE:
+		ews_dump_raw_soup_request (sd->message);
+
 		soup_session_queue_message (
 			sd->cnc->priv->soup_session, sd->message,
 			sd->queue_callback, sd->queue_user_data);
@@ -628,15 +652,6 @@ ews_next_request (gpointer _cnc)
 
 	node = (EwsNode *) l->data;
 
-	if (e_ews_debug_get_log_level () == 1) {
-		soup_buffer_free (soup_message_body_flatten (SOUP_MESSAGE (node->msg)->request_body));
-		/* print request's body */
-		printf ("\n The request headers");
-		fputc ('\n', stdout);
-		fputs (SOUP_MESSAGE (node->msg)->request_body->data, stdout);
-		fputc ('\n', stdout);
-	}
-
 	/* Remove the node from the priority queue */
 	cnc->priv->jobs = g_slist_remove (cnc->priv->jobs, (gconstpointer *) node);
 
@@ -645,15 +660,8 @@ ews_next_request (gpointer _cnc)
 
 	if (cnc->priv->soup_session) {
 		SoupMessage *msg = SOUP_MESSAGE (node->msg);
-		CamelEwsSettings *ews_settings = e_ews_connection_ref_settings (cnc);
-		gchar *auth_mech = NULL;
-
-		g_object_get (G_OBJECT (ews_settings), "auth-mechanism", &auth_mech, NULL);
-		if (g_strcmp0 (auth_mech, "GSSAPI") == 0)
-			e_ews_connection_utils_setup_msg_gssapi_auth (cnc, cnc->priv->soup_session, msg);
 
-		g_object_unref (ews_settings);
-		g_free (auth_mech);
+		ews_dump_raw_soup_request (msg);
 
 		soup_session_queue_message (cnc->priv->soup_session, msg, ews_response_cb, node);
 		QUEUE_UNLOCK (cnc);
@@ -1693,6 +1701,7 @@ e_ews_connection_class_init (EEwsConnect
 	g_type_class_add_private (class, sizeof (EEwsConnectionPrivate));
 
 	object_class = G_OBJECT_CLASS (class);
+	object_class->constructor = ews_connection_constructor;
 	object_class->set_property = ews_connection_set_property;
 	object_class->get_property = ews_connection_get_property;
 	object_class->dispose = ews_connection_dispose;
@@ -1751,6 +1760,8 @@ e_ews_connection_folders_list_free (gpoi
 static void
 e_ews_connection_authenticator_init (ESourceAuthenticatorInterface *iface)
 {
+	iface->get_without_password = 
+		ews_connection_get_without_password;
 	iface->try_password_sync = ews_connection_try_password_sync;
 }
 
@@ -1817,6 +1828,25 @@ e_ews_soup_log_printer (SoupLogger *logg
 	g_debug ("%c %s", direction, filtered_data ? filtered_data : data);
 }
 
+static GObject *
+ews_connection_constructor (GType                  gtype,
+			    guint                  n_properties,
+			    GObjectConstructParam  *properties)
+{
+	GObject *obj = G_OBJECT_CLASS (e_ews_connection_parent_class)->
+		constructor (gtype, n_properties, properties);
+	
+	EEwsConnection *cnc = E_EWS_CONNECTION (obj);
+	CamelEwsSettings *ews_settings = e_ews_connection_ref_settings (cnc);
+
+	if (e_ews_connection_utils_get_without_password (ews_settings)) {
+		soup_session_add_feature_by_type (cnc->priv->soup_session,
+						  SOUP_TYPE_AUTH_NEGOTIATE);
+	}
+
+	return obj;
+}
+
 static void
 e_ews_connection_init (EEwsConnection *cnc)
 {
@@ -1865,6 +1895,10 @@ e_ews_connection_init (EEwsConnection *c
 		g_object_unref (logger);
 	}
 
+	soup_session_add_feature_by_type (
+			cnc->priv->soup_session, 
+			SOUP_TYPE_COOKIE_JAR);
+
 	cnc->priv->subscriptions = g_hash_table_new_full (
 			g_direct_hash, g_direct_equal,
 			NULL, e_ews_connection_folders_list_free);
@@ -2288,6 +2322,8 @@ e_ews_connection_set_password (EEwsConne
 		memset (cnc->priv->password, 0, strlen (cnc->priv->password));
 
 	g_free (cnc->priv->password);
+	if (!password)
+		password = "";
 	cnc->priv->password = g_strdup (password);
 
 	g_mutex_unlock (&cnc->priv->property_lock);
@@ -2421,6 +2457,39 @@ autodiscover_data_free (struct _autodisc
 	g_slice_free (struct _autodiscover_data, ad);
 }
 
+static void 
+print_header (const char *name,
+              const char *value,
+              gpointer user_data)
+{
+	printf( "\n%s: %s", name, value);
+}
+
+static void
+ews_dump_raw_soup_request (SoupMessage *msg)
+{
+	gint log_level;
+
+	log_level = e_ews_debug_get_log_level ();
+	if (log_level >= 1 && log_level < 3) {
+		if (soup_message_body_get_accumulate (
+					SOUP_MESSAGE (msg)->request_body))
+			soup_buffer_free (
+					soup_message_body_flatten (
+						SOUP_MESSAGE (msg)->request_body));
+		/* print request body */
+		printf ("\n URI: %s", soup_uri_to_string (soup_message_get_uri (msg), TRUE));
+		printf ("\n The request headers for message %p", msg);
+		printf ("\n =====================");
+		soup_message_headers_foreach (SOUP_MESSAGE (msg)->request_headers, print_header, NULL);
+		fputc ('\n', stdout);
+		if (SOUP_MESSAGE (msg)->request_body->data)
+			fputs (SOUP_MESSAGE (msg)->request_body->data, stdout);
+		fputc ('\n', stdout);
+		fflush (stdout);
+	}
+}
+
 static void
 ews_dump_raw_soup_response (SoupMessage *msg)
 {
@@ -2428,13 +2497,21 @@ ews_dump_raw_soup_response (SoupMessage
 
 	log_level = e_ews_debug_get_log_level ();
 	if (log_level >= 1 && log_level < 3) {
-		soup_buffer_free (soup_message_body_flatten (SOUP_MESSAGE (msg)->response_body));
+		if (soup_message_body_get_accumulate (
+					SOUP_MESSAGE (msg)->response_body))
+			soup_buffer_free (
+					soup_message_body_flatten (
+						SOUP_MESSAGE (msg)->response_body));
 		/* print response body */
-		printf ("\n The response headers");
+		printf ("\n The response code: %d\n", msg->status_code);
+		printf ("\n The response headers for message %p", msg);
 		printf ("\n =====================");
+		soup_message_headers_foreach (SOUP_MESSAGE (msg)->response_headers, print_header, NULL);
 		fputc ('\n', stdout);
-		fputs (SOUP_MESSAGE (msg)->response_body->data, stdout);
+		if (SOUP_MESSAGE (msg)->response_body->data)
+			fputs (SOUP_MESSAGE (msg)->response_body->data, stdout);
 		fputc ('\n', stdout);
+		fflush (stdout);
 	}
 
 }
@@ -2605,6 +2682,11 @@ static void post_restarted (SoupMessage
 {
 	xmlOutputBuffer *buf = data;
 
+	if (msg->status_code == 401)
+	{
+		return;
+	}
+
 	/* In violation of RFC2616, libsoup will change a POST request to
 	 * a GET on receiving a 302 redirect. */
 	printf ("Working around libsoup bug with redirect\n");
@@ -2627,7 +2709,6 @@ e_ews_get_msg_for_url (const gchar *url,
                        GError **error)
 {
 	SoupMessage *msg;
-	gint log_level;
 
 	if (url == NULL) {
 		g_set_error_literal (
@@ -2663,18 +2744,7 @@ e_ews_get_msg_for_url (const gchar *url,
 			G_CALLBACK (post_restarted), buf);
 	}
 
-	log_level = e_ews_debug_get_log_level ();
-	if (log_level >= 1 && log_level < 3) {
-		soup_buffer_free (
-			soup_message_body_flatten (
-			SOUP_MESSAGE (msg)->request_body));
-		/* print request's body */
-		printf ("\n The request headers");
-		printf ("\n ===================");
-		fputc ('\n', stdout);
-		fputs (SOUP_MESSAGE (msg)->request_body->data, stdout);
-		fputc ('\n', stdout);
-	}
+	ews_dump_raw_soup_request (msg);
 
 	return msg;
 }
@@ -3384,6 +3454,8 @@ oal_download_response_cb (SoupSession *s
 		g_unlink (data->cache_filename);
 	}
 
+	ews_dump_raw_soup_response (soup_message);
+
 	g_simple_async_result_complete_in_idle (simple);
 	e_ews_connection_utils_unref_in_thread (simple);
 }
diff -up evolution-ews-3.12.4/src/server/e-ews-connection-utils.c.gssapi-fix evolution-ews-3.12.4/src/server/e-ews-connection-utils.c
--- evolution-ews-3.12.4/src/server/e-ews-connection-utils.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/server/e-ews-connection-utils.c	2014-07-18 17:09:57.501421367 -0700
@@ -28,161 +28,29 @@
 #define EWS_GSSAPI_SASL		"ews-gssapi-sasl"
 #define EWS_GSSAPI_CONNECTION	"ews-gssapi-connection"
 
-static gchar *
-ews_connection_utils_gssapi_challenge (CamelSasl *sasl,
-				       const gchar *what,
-				       gboolean is_base64,
-				       GError **error)
-{
-	GByteArray *ain, *aout = NULL;
-	gchar *response = NULL;
-	GError *local_error = NULL;
-
-	g_return_val_if_fail (sasl != NULL, NULL);
-
-	ain = g_byte_array_new ();
-
-	if (what && *what) {
-		if (is_base64) {
-			guchar *bytes;
-			gsize len = 0;
-
-			bytes = g_base64_decode (what, &len);
-			if (bytes) {
-				g_byte_array_append (ain, bytes, len);
-				g_free (bytes);
-			}
-		} else {
-			g_byte_array_append (ain, (const guchar *) what, strlen (what));
-		}
-	}
-
-	aout = camel_sasl_challenge_sync (sasl, ain, NULL, &local_error);
-
-	if (local_error) {
-		g_propagate_error (error, local_error);
-	} else if (aout && aout->len) {
-		response = g_base64_encode (aout->data, aout->len);
-	} else {
-		response = g_strdup ("");
-	}
-
-	g_byte_array_unref (ain);
-
-	if (aout)
-		g_byte_array_unref (aout);
-
-	return response;
-}
-
-static void
-ews_connection_utils_authenticate_gssapi_cb (SoupMessage *message,
-					     gpointer user_data)
-{
-	EEwsConnection *connection = g_object_get_data (G_OBJECT (message), EWS_GSSAPI_CONNECTION);
-	SoupSession *session = g_object_get_data (G_OBJECT (message), EWS_GSSAPI_SOUP_SESSION);
-	CamelSasl *sasl = g_object_get_data (G_OBJECT (message), EWS_GSSAPI_SASL);
-	const gchar *auths_lst;
-	gchar **auths;
-	gint ii;
-
-	g_return_if_fail (E_IS_EWS_CONNECTION (connection));
-	g_return_if_fail (SOUP_IS_SESSION (session));
-	g_return_if_fail (CAMEL_IS_SASL (sasl));
-
-	if (SOUP_STATUS_IS_SUCCESSFUL (message->status_code))
-		return;
-
-	auths_lst = soup_message_headers_get_list (message->response_headers, "WWW-Authenticate");
-	if (!auths_lst)
-		return;
-
-	auths = g_strsplit (auths_lst, ",", -1);
-	for (ii = 0; auths && auths[ii]; ii++) {
-		if (g_ascii_strncasecmp (auths[ii], "Negotiate", 9) == 0) {
-			GError *error = NULL;
-			const gchar *chlg = auths[ii] + 9;
-			gchar *response;
-
-			if (*chlg)
-				chlg++;
-			if (!*chlg)
-				chlg = NULL;
-
-			response = ews_connection_utils_gssapi_challenge (
-				sasl, chlg ? chlg : "\r\n", chlg != NULL, &error);
-
-			if (response && *response) {
-				gchar *sasl_response = g_strconcat ("Negotiate ", response, NULL);
-
-				soup_message_headers_remove (message->request_headers, "Authorization");
-				soup_message_headers_append (message->request_headers, "Authorization", sasl_response);
-				soup_session_requeue_message (session, message);
-
-				g_free (sasl_response);
-			} else if (error) {
-				/* cannot use SOUP_STATUS_UNAUTHORIZED, because it may hide an error message,
-				   which is a local error of Kerberos/GSSAPI call */
-				soup_message_set_status_full (message, SOUP_STATUS_BAD_REQUEST, error->message);
-			}
-
-			g_free (response);
-			break;
-		}
-	}
-
-	g_strfreev (auths);
-}
-
-void
-e_ews_connection_utils_setup_msg_gssapi_auth (EEwsConnection *connection,
-					      SoupSession *session,
-					      SoupMessage *message)
-{
-	CamelSasl *gssapi_sasl;
-	CamelEwsSettings *ews_settings;
-	CamelNetworkSettings *network_settings;
-	SoupURI *soup_uri;
-	const gchar *host, *user;
-
-	if (!camel_sasl_gssapi_is_available ())
-		return;
-
-	g_return_if_fail (E_IS_EWS_CONNECTION (connection));
-	g_return_if_fail (SOUP_IS_MESSAGE (message));
-
-	ews_settings = e_ews_connection_ref_settings (connection);
-	network_settings = CAMEL_NETWORK_SETTINGS (ews_settings);
-	gssapi_sasl = g_object_new (
-		camel_sasl_gssapi_get_type (),
-		"mechanism", "GSSAPI",
-		"service-name", "HTTP",
-		NULL);
-
-	soup_uri = soup_message_get_uri (message);
-	host = soup_uri_get_host (soup_uri);
-	user = soup_uri_get_user (soup_uri);
-	if (!host || !*host)
-		host = camel_network_settings_get_host (network_settings);
-	if (!user || !*user)
-		user = camel_network_settings_get_user (network_settings);
-
-	camel_sasl_gssapi_override_host_and_user (CAMEL_SASL_GSSAPI (gssapi_sasl), host, user);
-
-	/* this might not be a cyclic ref dependency, as long as the message
-	   is properly served through the session and freed */
-	g_object_set_data_full (G_OBJECT (message), EWS_GSSAPI_SOUP_SESSION,
-		g_object_ref (session), g_object_unref);
-	g_object_set_data_full (G_OBJECT (message), EWS_GSSAPI_CONNECTION,
-		g_object_ref (connection), e_ews_connection_utils_unref_in_thread);
-	g_object_set_data_full (G_OBJECT (message), EWS_GSSAPI_SASL,
-		gssapi_sasl, g_object_unref);
-
-	soup_message_add_header_handler (message, "got_body", "WWW-Authenticate",
-		G_CALLBACK (ews_connection_utils_authenticate_gssapi_cb), NULL);
-
-	g_object_unref (ews_settings);
-}
+/*
+ * The following set of functions hacks in Negotiate/GSSAPI support for EWS.  
+ * Ideally, libsoup should provide the support already.  Unfortunately, it
+ * doesn't.
+ *
+ * Next ideally would be to implement a private Negotiate auth module for
+ * libsoup.  However, a SoupSession can maintain multiple connections, and
+ * GSSAPI exchanges can require an arbitrary number of round trips, which
+ * means that the auth module must maintain per-connection state.
+ *
+ * Libsoup does define a class SoupConnectionAuth, which NTLM support 
+ * subclasses, but the class is private and not available to outsiders.
+ *
+ * It would almost be possible to implement the important aspects of
+ * SoupConnectionAuth in a private auth module, except that the 
+ * soup_message_get_connection() call is also private and not exported.
+ *
+ * So this leaves the hack presented here.  It waits for libsoup to get the
+ * message constructed, then through a callback that it installs, intercepts 
+ * the server reply, parses the WWW-Authenticate reply, replaces the
+ * Authorization header in the request, and requeues the request.
+ *
+ */
 
 static gpointer
 ews_unref_in_thread_func (gpointer data)
@@ -241,4 +109,18 @@ e_ews_connection_utils_check_element (co
 	return TRUE;
 }
 
+/* Return TRUE if using GSSAPI.  */
+gboolean
+e_ews_connection_utils_get_without_password (CamelEwsSettings *ews_settings)
+{
+	gboolean result = FALSE;
+	gchar *auth_mech = NULL;
+
+	g_object_get (G_OBJECT (ews_settings), "auth-mechanism", &auth_mech, NULL);
+	if (g_strcmp0 (auth_mech, "GSSAPI") == 0)
+		result = TRUE;
+
+	g_free (auth_mech);
 
+	return result;
+}
diff -up evolution-ews-3.12.4/src/server/e-ews-connection-utils.h.gssapi-fix evolution-ews-3.12.4/src/server/e-ews-connection-utils.h
--- evolution-ews-3.12.4/src/server/e-ews-connection-utils.h.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/server/e-ews-connection-utils.h	2014-07-18 17:09:57.501421367 -0700
@@ -27,10 +27,6 @@ G_BEGIN_DECLS
 #define E_EWS_CONNECTION_UTILS_CHECK_ELEMENT(element_name, expected_name) \
 	(e_ews_connection_utils_check_element (G_STRFUNC, (element_name), (expected_name)))
 
-void		e_ews_connection_utils_setup_msg_gssapi_auth
-							(EEwsConnection *connection,
-							 SoupSession *session,
-							 SoupMessage *message);
 void		e_ews_connection_utils_unref_in_thread	(gpointer object);
 gboolean	e_ews_connection_utils_auth_mech_to_use_ntlm
 							(GBinding *binding,
@@ -41,6 +37,9 @@ gboolean	e_ews_connection_utils_check_el
 							 const gchar *element_name,
 							 const gchar *expected_name);
 
+gboolean	e_ews_connection_utils_get_without_password
+							(CamelEwsSettings *ews_settings);
+
 G_END_DECLS
 
 #endif /* E_EWS_CONNECTION_UTILS_H */
diff -up evolution-ews-3.12.4/src/server/e-ews-notification.c.gssapi-fix evolution-ews-3.12.4/src/server/e-ews-notification.c
--- evolution-ews-3.12.4/src/server/e-ews-notification.c.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/server/e-ews-notification.c	2014-07-18 17:09:57.501421367 -0700
@@ -267,13 +267,11 @@ e_ews_notification_subscribe_folder_sync
 					  gchar **subscription_id,
 					  GCancellable *cancellable)
 {
-	CamelEwsSettings *ews_settings;
 	ESoapMessage *msg;
 	ESoapResponse *response;
 	ESoapParameter *param, *subparam;
 	GError *error = NULL;
 	GSList *l;
-	gchar *auth_mech = NULL;
 	guint event_type;
 	xmlDoc *doc;
 
@@ -325,18 +323,6 @@ e_ews_notification_subscribe_folder_sync
 
 	soup_message_body_set_accumulate (SOUP_MESSAGE (msg)->response_body, TRUE);
 
-	ews_settings = e_ews_connection_ref_settings (notification->priv->connection);
-
-	g_object_get (G_OBJECT (ews_settings), "auth-mechanism", &auth_mech, NULL);
-	if (g_strcmp0 (auth_mech, "GSSAPI") == 0)
-		e_ews_connection_utils_setup_msg_gssapi_auth (
-			notification->priv->connection,
-			notification->priv->soup_session,
-			SOUP_MESSAGE (msg));
-
-	g_object_unref (ews_settings);
-	g_free (auth_mech);
-
 	if (g_cancellable_is_cancelled (cancellable)) {
 		g_object_unref (msg);
 		return FALSE;
diff -up evolution-ews-3.12.4/src/server/Makefile.am.gssapi-fix evolution-ews-3.12.4/src/server/Makefile.am
--- evolution-ews-3.12.4/src/server/Makefile.am.gssapi-fix	2014-03-24 02:28:36.000000000 -0700
+++ evolution-ews-3.12.4/src/server/Makefile.am	2014-07-18 17:09:57.509421146 -0700
@@ -59,8 +59,11 @@ libeews_1_2_la_SOURCES = \
 	e-soap-response.h \
 	e-source-ews-folder.c \
 	e-source-ews-folder.h \
+	soup-auth-negotiate.c \
+	soup-auth-negotiate.h \
 	$(NULL)
 
+
 libeews_1_2_la_LIBADD = \
 	$(SOUP_LIBS) \
 	$(LIBECAL_LIBS) \
diff -up evolution-ews-3.12.4/src/server/soup-auth-negotiate.c.gssapi-fix evolution-ews-3.12.4/src/server/soup-auth-negotiate.c
--- evolution-ews-3.12.4/src/server/soup-auth-negotiate.c.gssapi-fix	2014-07-18 17:09:57.509421146 -0700
+++ evolution-ews-3.12.4/src/server/soup-auth-negotiate.c	2014-07-18 17:09:57.509421146 -0700
@@ -0,0 +1,377 @@
+/*
+ * soup-auth-negotiate.c
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with the program; if not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <string.h>
+
+#include <camel/camel.h>
+#include <libsoup/soup.h>
+#include "soup-auth-negotiate.h"
+
+/*
+ * The following set of functions hacks in Negotiate/GSSAPI support for EWS.  
+ * Ideally, libsoup should provide the support already.  Unfortunately, it
+ * doesn't.
+ *
+ * Authentication could possibly be configured as connection-based, but it
+ * seems to be message-based by default.  This is fine with us, since it 
+ * facilitates attaching a GSSAPI context to the message, and there is no 
+ * need to resort to dirty tricks to discover the connection pointer.
+ *
+ * Connection-based auth should also work with this scheme since we only 
+ * attempt authentication when told to do so.  If libsoup offered a way to
+ * peek at the connection, though, it would allow use of the "Persistent-Auth"
+ * header to predict that case and avoid an extra round trip.
+ *
+ */
+
+typedef struct {
+	char *user;
+} SoupAuthNegotiatePrivate;
+
+typedef struct {
+	CamelSasl *gssapi_sasl;
+	char *token;
+	char *challenge;
+	int  auth_started;
+	int  challenge_available;
+} SoupMessageState;
+
+static GHashTable *msgs_table;
+
+static gchar *
+soup_auth_negotiate_gssapi_challenge (CamelSasl *sasl,
+				      const gchar *what,
+				      gboolean is_base64,
+				      GError **error)
+{
+	GByteArray *ain, *aout = NULL;
+	gchar *response = NULL;
+	GError *local_error = NULL;
+
+	g_return_val_if_fail (sasl != NULL, NULL);
+
+	ain = g_byte_array_new ();
+
+	if (what && *what) {
+		if (is_base64) {
+			guchar *bytes;
+			gsize len = 0;
+
+			bytes = g_base64_decode (what, &len);
+			if (bytes) {
+				g_byte_array_append (ain, bytes, len);
+				g_free (bytes);
+			}
+		} else {
+			g_byte_array_append (ain, (const guchar *) what, strlen (what));
+		}
+	}
+
+	aout = camel_sasl_challenge_sync (sasl, ain, NULL, &local_error);
+
+	if (local_error) {
+		g_propagate_error (error, local_error);
+	} else if (aout && aout->len) {
+		response = g_base64_encode (aout->data, aout->len);
+	} else {
+		response = g_strdup ("");
+	}
+
+	g_byte_array_unref (ain);
+
+	if (aout)
+		g_byte_array_unref (aout);
+
+	return response;
+}
+
+static gboolean
+soup_auth_negotiate_update (SoupAuth *auth, SoupMessage *msg,
+			GHashTable *auth_params);
+
+static gboolean
+soup_auth_negotiate_is_ready (SoupAuth *auth,
+			      SoupMessage *msg);
+static void
+soup_auth_negotiate_message_finished (SoupMessage *msg, gpointer user_data);
+
+static void
+soup_auth_negotiate_delete_context (SoupMessage *msg, gpointer user_data)
+{
+	SoupMessageState *state = g_hash_table_lookup (msgs_table, msg);
+
+	g_hash_table_remove (msgs_table, msg);
+	g_signal_handlers_disconnect_by_func (
+		msg, G_CALLBACK (soup_auth_negotiate_message_finished), 
+		user_data);
+
+	g_object_unref (state->gssapi_sasl);
+	g_free (state->token);
+	g_free (state->challenge);
+	g_slice_free (SoupMessageState, state);
+}
+
+static void
+soup_auth_negotiate_message_finished (SoupMessage *msg, gpointer user_data)
+{
+	/*
+	 * Feed the remaining GSSAPI data through SASL
+	 */
+	SoupAuth *auth = SOUP_AUTH (user_data);
+	if (msg->status_code == 200)
+	{
+		if (soup_auth_negotiate_update (auth, msg, NULL)) {
+			soup_auth_negotiate_is_ready (auth, msg);
+		}
+	}
+
+	soup_auth_negotiate_delete_context (msg, user_data);
+}
+
+static SoupMessageState *
+soup_auth_negotiate_get_message_state (SoupMessage *msg, SoupAuth *auth)
+{
+	SoupMessageState *state;
+
+	state = g_hash_table_lookup (msgs_table, msg);
+	if (!state) {
+		state = g_slice_new0 (SoupMessageState);
+		g_hash_table_insert (msgs_table, msg, state);
+		g_signal_connect (
+			msg, "finished", 
+			G_CALLBACK (soup_auth_negotiate_message_finished), 
+			auth);
+	}
+
+	return state;
+}
+
+#define SOUP_AUTH_NEGOTIATE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), SOUP_TYPE_AUTH_NEGOTIATE, SoupAuthNegotiatePrivate))
+
+/**
+ * SOUP_TYPE_AUTH_NEGOTIATE:
+ *
+ * A #GType corresponding to HTTP "Negotiate" authentication.
+ * #SoupSessions support this by default; if you want to disable
+ * support for it, call soup_session_remove_feature_by_type(),
+ * passing %SOUP_TYPE_AUTH_NEGOTIATE.
+ *
+ * Since: 2.34
+ */
+
+G_DEFINE_TYPE (SoupAuthNegotiate, soup_auth_negotiate, SOUP_TYPE_AUTH)
+
+static void
+soup_auth_negotiate_init (SoupAuthNegotiate *negotiate)
+{
+}
+
+static void
+soup_auth_negotiate_finalize (GObject *object)
+{
+	SoupAuthNegotiatePrivate *priv = SOUP_AUTH_NEGOTIATE_GET_PRIVATE (object);
+	g_free (priv->user);
+	G_OBJECT_CLASS (soup_auth_negotiate_parent_class)->finalize (object);
+}
+
+static gboolean
+soup_auth_negotiate_update (SoupAuth *auth, SoupMessage *msg,
+			GHashTable *auth_params)
+{
+	/*
+ 	 * Basically all we do here is update the challenge
+ 	 */
+	SoupMessageState *state = soup_auth_negotiate_get_message_state (
+		msg, auth);
+	const gchar *auths_lst;
+	gchar **auths;
+	gint ii;
+
+	/*
+ 	 * The auth_params is supposed to have the challenge.  But the
+ 	 * Negotiate challenge doesn't fit the standard so it must be extracted
+ 	 * from the msg instead.
+ 	 */
+	auths_lst = soup_message_headers_get_list (
+		msg->response_headers, "WWW-Authenticate");
+	if (!auths_lst)
+		return FALSE;
+
+	auths = g_strsplit (auths_lst, ",", -1);
+	for (ii = 0; auths && auths[ii]; ii++) {
+		if (g_ascii_strncasecmp (auths[ii], "Negotiate", 9) == 0) {
+			const gchar *chlg = auths[ii] + 9;
+
+			if (state->challenge)
+				g_free (state->challenge);
+			if (*chlg)
+				chlg++;
+			if (!*chlg)
+				chlg = NULL;
+			state->challenge = g_strdup (chlg);
+			state->challenge_available = TRUE;
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+}
+
+static GSList *
+soup_auth_negotiate_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
+{
+	char *space, *p;
+
+	space = g_strdup (source_uri->path);
+
+	/* Strip filename component */
+	p = strrchr (space, '/');
+	if (p && p != space && p[1])
+		*p = '\0';
+
+	return g_slist_prepend (NULL, space);
+}
+
+static void
+soup_auth_negotiate_authenticate (SoupAuth *auth, const char *username,
+			      const char *password)
+{
+	/*
+ 	 * All we do here is update the username
+ 	 */
+	SoupAuthNegotiatePrivate *priv = SOUP_AUTH_NEGOTIATE_GET_PRIVATE (auth);
+	g_free (priv->user);
+	priv->user = g_strdup (username);
+}
+
+static gboolean
+soup_auth_negotiate_is_ready (SoupAuth *auth,
+			      SoupMessage *msg)
+{
+	SoupMessageState *state = NULL;
+
+	/*
+ 	 * Here we finally update the token and then inform the auth manager
+ 	 * that it's ready.
+ 	 */
+
+	state = soup_auth_negotiate_get_message_state (msg, auth);
+
+	if (!state->auth_started) {
+		CamelSasl *gssapi_sasl;
+		SoupURI *soup_uri;
+		char const *host;
+		SoupAuthNegotiatePrivate *priv = SOUP_AUTH_NEGOTIATE_GET_PRIVATE (auth);
+
+		gssapi_sasl = g_object_new (
+			camel_sasl_gssapi_get_type (),
+			"mechanism", "GSSAPI",
+			"service-name", "HTTP",
+			NULL);
+
+		soup_uri = soup_message_get_uri (msg);
+		host = soup_uri_get_host (soup_uri);
+
+		camel_sasl_gssapi_override_host_and_user (
+			CAMEL_SASL_GSSAPI (gssapi_sasl), host, priv->user);
+
+		state->gssapi_sasl = gssapi_sasl;
+
+		state->auth_started = TRUE;
+	}
+
+	if (state->challenge_available) { 
+		GError *error = NULL;
+
+		g_free (state->token);
+		state->token = soup_auth_negotiate_gssapi_challenge (
+				state->gssapi_sasl, 
+				state->challenge ? state->challenge : "\r\n", 
+				state->challenge != NULL, 
+				&error);
+
+		g_free (state->challenge);
+		state->challenge = NULL;
+		state->challenge_available = FALSE;
+
+		if (error) {
+			/* cannot use SOUP_STATUS_UNAUTHORIZED, because it may hide an 
+			 * error message, which is a local error of Kerberos/GSSAPI 
+			 * call 
+			 */
+			soup_message_set_status_full (
+				msg, SOUP_STATUS_BAD_REQUEST, error->message);
+			return FALSE;
+		}
+	}
+
+	if (state->token != NULL)
+		return TRUE;
+	return FALSE;
+}
+
+static gboolean
+soup_auth_negotiate_is_authenticated (SoupAuth *auth)
+{
+/*
+	SoupAuthNegotiatePrivate *priv = SOUP_AUTH_NEGOTIATE_GET_PRIVATE (auth);
+*/
+	return FALSE;
+}
+
+static char *
+soup_auth_negotiate_get_authorization (SoupAuth *auth, SoupMessage *msg)
+{
+	char *token;
+	SoupMessageState *state = soup_auth_negotiate_get_message_state 
+		(msg, auth);
+
+	token = g_strdup_printf ("Negotiate %s", state->token);
+
+	g_free (state->token);
+	state->token = NULL;
+
+	return token;
+}
+
+static void
+soup_auth_negotiate_class_init (SoupAuthNegotiateClass *auth_negotiate_class)
+{
+	SoupAuthClass *auth_class = SOUP_AUTH_CLASS (auth_negotiate_class);
+	GObjectClass *object_class = G_OBJECT_CLASS (auth_negotiate_class);
+
+	g_type_class_add_private (auth_negotiate_class, sizeof (SoupAuthNegotiatePrivate));
+
+	auth_class->scheme_name = "Negotiate";
+	auth_class->strength = 1;
+
+	auth_class->update = soup_auth_negotiate_update;
+	auth_class->get_protection_space = soup_auth_negotiate_get_protection_space;
+	auth_class->authenticate = soup_auth_negotiate_authenticate;
+	auth_class->is_ready = soup_auth_negotiate_is_ready;
+	auth_class->is_authenticated = soup_auth_negotiate_is_authenticated;
+	auth_class->get_authorization = soup_auth_negotiate_get_authorization;
+
+	object_class->finalize = soup_auth_negotiate_finalize;
+
+	msgs_table = g_hash_table_new (NULL, NULL);
+}
diff -up evolution-ews-3.12.4/src/server/soup-auth-negotiate.h.gssapi-fix evolution-ews-3.12.4/src/server/soup-auth-negotiate.h
--- evolution-ews-3.12.4/src/server/soup-auth-negotiate.h.gssapi-fix	2014-07-18 17:09:57.510421118 -0700
+++ evolution-ews-3.12.4/src/server/soup-auth-negotiate.h	2014-07-18 17:09:57.510421118 -0700
@@ -0,0 +1,31 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2000-2003, Ximian, Inc.
+ */
+
+#ifndef SOUP_AUTH_NEGOTIATE_H
+#define SOUP_AUTH_NEGOTIATE_H 1
+
+#include "libsoup/soup.h"
+
+#define SOUP_TYPE_AUTH_NEGOTIATE \
+	(soup_auth_negotiate_get_type ())
+#define SOUP_AUTH_NEGOTIATE(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), SOUP_TYPE_AUTH_NEGOTIATE, SoupAuthNegotiate))
+#define SOUP_AUTH_NEGOTIATE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), SOUP_TYPE_AUTH_NEGOTIATE, SoupAuthNegotiate))
+#define SOUP_IS_AUTH_NEGOTIATE(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), SOUP_TYPE_AUTH_NEGOTIATE))
+#define SOUP_IS_AUTH_NEGOTIATE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), SOUP_TYPE_AUTH_NEGOTIATE))
+#define SOUP_AUTH_NEGOTIATE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), SOUP_TYPE_AUTH_NEGOTIATE, SoupAuthNegotiateClass))
+
+typedef struct {
+	SoupAuth parent;
+
+} SoupAuthNegotiate;
+
+typedef struct {
+	SoupAuthClass  parent_class;
+
+} SoupAuthNegotiateClass;
+
+GType soup_auth_negotiate_get_type (void);
+
+#endif /*SOUP_AUTH_NEGOTIATE_H*/
