There was an excellent document from long ago (that I printed out) titled "WebSphere with a side of SPNEGO" that explained it well. My googling is failing me at the moment; I can't find the document on any kind of IBM support site -- if I could, I'd provide a link. I did find it on other sites though. . .
Quoting the first sentence in that document:
"SPNEGO, or the Simple and Protected GSSAPI Negotiation Mechanism, enables a straightforward single sign-on (SSO) mechanism for WebSphere in Kerberos environments."
How to tell if you have it? A good indicator would be:
log into WebSphere;
choose Global Security from the left menu;
expand Web and SIP security;
choose SPNEGO Web authentication;
see if the 'Enable SPNEGO' checkbox is checked
------------------------------
Travis Herron
Pensacola Christian College
------------------------------