The problem was that Chromium (Edge/Chrome) thinks that our internal app-domain is located on the internet, and therefore ignores the Integrated Windows Authentication (NTLM) request.
To recap how Integrated Windows Authentication works in Edge/Chrome:
From Microsoft:
- By default, Microsoft Edge uses the intranet zone as an allow-list for WIA.
- Alternatively, you can customize the list of servers that are enabled for Integrated Authentication by using the AuthServerAllowlist policy.
Unfortunately, there is not much documentation of the interplay between these settings, or what logic "AuthServerAllowlist" uses for determining what sites are internal.
Our app domain was already added to IE:s Local Intranet sites (Edge's ties to Internet Explorer are still here... sigh), so it should not have been a problem. For as of yet unconfirmed reasons it is a problem for several users anyway, maybe due to issues with the GPO application.
When I add the URL to the "AuthServerAllowlist" regkey (see docs for Edge/Chrome) the login prompt disappears. Unfortunately, it seems to be an all-or-nothing solution - now all other internal URLs have to be explicitly added as well or they will prompt you.
Reg location for "AuthServerAllowlist":
- Edge: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
- Chrome: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
As I see it, "AuthServerAllowlist" (and sister policies, see Edge HTTP authentication policies) is the true replacement in Edge/Chrome for Internet Explorer's Local Intranet sites option. This new policy has been around since Edge 77, in June 2019, but there is a lot of old instructions and blog posts floating around that only ever mentions the ancient Internet Explorer settings.
