Anthony Clark via FreeIPA-users <>

> Please ignore, bad copy and paste.
> Version 22 of the ipa.conf (the second pasted config section) is the one
> that works correctly.
> Is there a way to disable Kerberos browser-side popup password box in
> version 27 of the ipa.conf file?

My apache configuration knowledge is not deep enough to answer your
question directly.  However:

If I understand what you're asking: the error is caused by Windows
browsers (chrome, IE, and edge but not firefox) not handling GSSAPI
negotiate requests correctly.  We have added a new feature to
mod_auth_gssapi for this - set the environment variable

    BrowserMatch Windows gssapi-no-negotiate

and Windows clients will not see the box.

(This feature was added in mod_auth_gssapi version 1.6.0, which is in
fedora >= 27; this feature will also be a part of el7.5.)


Attachment: signature.asc
Description: PGP signature

FreeIPA-users mailing list --
To unsubscribe send an email to

Reply via email to