This behavior can be corrected through the browsers configuration. There are tools that can even manage such configurations, enterprise wide. For IE, you place the domain in your intranet sites (i.e., *.domain.com). For FireFox, you set the following parameters:
network.negotiate-auth.delegation-uris (.domain.com) network.negotiate-auth.trusted-uris (.domain.com) Chrome leverages the IE configuration. There are 2 cases where the fail back is used: - A valid TGT is not available (either TGT expired or not workstation is not Kerberized) - The client is not Kerberized (in this case, almost every http agent support basic auth) You might be surprised how happy people are to be able to access their web applications without having to sign in at all; just logging into their workstation gives them access to the web apps. In this scenario, if a user chooses not to do SPNEGO/Kerberos for one reason or another, they have another way to successfully authenticate, which will effectively work with just about any browser. Axton On Thu, Jun 30, 2011 at 3:58 PM, John Baker <[email protected]>wrote: > Axton, > > "We use basic authentication as a fail back in the event SPNEGO fails." > > So you're missing SSO for a number of browsers that decide to send an NTLM > token, or an NTLM token buried in an SPNEGO token. That's quite a large > piece of functionality for large BMC clients who may have 20,000+ desktops > with some percentage refusing to do Kerberos for one reason or another. Only > an hour ago did I find myself telling a client that just because SSO Plugin > was configured to perform Kerbeors only, this wouldn't stop NTLM, and the > logs confirmed as much: > > 18:49:57,372 JSS DEBUG - Browser: Mozilla/4.0 (compatible; MSIE 8.0; > Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; > .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) > 18:49:57,372 JSS DEBUG - Authorisation: Negotiate > TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== > 18:49:57,372 JSS DEBUG - Detected Negotiate header with NTLM token: > Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== > 18:49:57,372 JSS DEBUG - Browser tried to pass an NTLM token but > authentication mode set to SPENGO/Kerberos only. Responding with > unauthorized and a request for SPNEGO/Kerberos. > 18:49:57,372 JSS DEBUG - Sending WWW-Authenticate: Negotiate > 18:49:57,372 JSS DEBUG - Returning HTTP Unauthorised > > You will note that this browser decided to send a Negotioate (SPNEGO) > header with an NTLM token. > > > John > -- > Single Sign On for BMC ITSM & Dashboards > http://www.javasystemsolutions.com/jss/ssoplugin > > > _______________________________________________________________________________ > UNSUBSCRIBE or access ARSlist Archives at www.arslist.org > attend wwrug11 www.wwrug.com ARSList: "Where the Answers Are" > _______________________________________________________________________________ UNSUBSCRIBE or access ARSlist Archives at www.arslist.org attend wwrug11 www.wwrug.com ARSList: "Where the Answers Are"
