Kerberos on Chrome, Safari or FireFox

Question

recently enabled Kerberos on my SharePoint 2010 install. If I browse from IE, I see logins authenticate over Kerberos protocol. If I browse from any other browser (Chrome, Firefox, Safari..), NTLM is used.

Is Kerberos a valid protocol for these other browsers? Is there a way for me to force authentication over Kerberos? At one point, I removed NTLM from my authentication providers altogether, but that only prevented these other browsers from even accessing my site.

Thanks!

Answer 1

I have a SharePoint 2010 site that has Kerberos auth properly configured and is added to my "Trusted Sites" in Internet Options.

Using KerbTray I get a Kerberos ticket on both Chrome and FireFox. I purged tickets before each attempt.

I then opened SQL Server Management Studio and connected to the SharePoint DB server. I opened a new query window and used the following SQL:

SELECT
    c.session_id
   ,s.login_name
   ,c.auth_scheme
   ,c.net_transport
   ,s.host_name
   ,s.login_time

FROM sys.dm_exec_connections c
INNER JOIN sys.dm_exec_sessions s on s.session_id = c.session_id 

I opened FireFox and watched my session authenticate and saw my domain user account hitting the system with Kerberos. I did have to configure FireFox to use Windows Auth, but I am pretty sure recent versions of Chrome automatically use Windows auth and will understand Kerberos just fine. Is your site in "Trusted Sites"? That's all I can think to have you check.

EDIT: I just saw this blog post http://stevehorsfield.wordpress.com/2011/10/09/chrome-almost-supports-sso-in-windows-kerberos-environments/

In DNS are you using a CNAME or an A record for your SharePoint site's domain name?

You can check using nslookup via a command prompt:

C:\Users\Bob>nslookup mail.creideamh.org
Server:  dns-01.domain.local
Address:  192.168.0.2

Non-authoritative answer:
Name:    server.domain.local
Addresses: 192.168.1.203
Aliases:  portal.domain.com

Notice the Name and Alias sections. A CNAME is an alias. You want an A record (Address record).

Answer 2

Enable FireFox Kerberos Trust

Open FireFox

In the Location bar, type about:config, and press enter. The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page.

In the about:config page, search for the preference network.negotiate-auth.trusted-uris, and double-click on it. (this list may not be in alphabetical order) In the prompt that comes up, type a list of servers or domains you want to allow, separated by a comma and a space. Enter the following: yourdomain.com. Click "OK"

You should now be able to access those websites with Kerberos enabled from FireFox without logging in.

Hope this helps.