Axton, "We use basic authentication as a fail back in the event SPNEGO fails."
So you're missing SSO for a number of browsers that decide to send an NTLM token, or an NTLM token buried in an SPNEGO token. That's quite a large piece of functionality for large BMC clients who may have 20,000+ desktops with some percentage refusing to do Kerberos for one reason or another. Only an hour ago did I find myself telling a client that just because SSO Plugin was configured to perform Kerbeors only, this wouldn't stop NTLM, and the logs confirmed as much: 18:49:57,372 JSS DEBUG - Browser: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) 18:49:57,372 JSS DEBUG - Authorisation: Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== 18:49:57,372 JSS DEBUG - Detected Negotiate header with NTLM token: Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== 18:49:57,372 JSS DEBUG - Browser tried to pass an NTLM token but authentication mode set to SPENGO/Kerberos only. Responding with unauthorized and a request for SPNEGO/Kerberos. 18:49:57,372 JSS DEBUG - Sending WWW-Authenticate: Negotiate 18:49:57,372 JSS DEBUG - Returning HTTP Unauthorised You will note that this browser decided to send a Negotioate (SPNEGO) header with an NTLM token. John -- Single Sign On for BMC ITSM & Dashboards http://www.javasystemsolutions.com/jss/ssoplugin _______________________________________________________________________________ UNSUBSCRIBE or access ARSlist Archives at www.arslist.org attend wwrug11 www.wwrug.com ARSList: "Where the Answers Are"
