1

recently enabled Kerberos on my SharePoint 2010 install. If I browse from IE, I see logins authenticate over Kerberos protocol. If I browse from any other browser (Chrome, Firefox, Safari..), NTLM is used.

Is Kerberos a valid protocol for these other browsers? Is there a way for me to force authentication over Kerberos? At one point, I removed NTLM from my authentication providers altogether, but that only prevented these other browsers from even accessing my site.

Thanks!

Improve this question
1
  • Safari is not capable of handling Kerberos, so you better exclude it from your list.
    – Norbert
    Dec 12, 2012 at 11:52

2 Answers 2

Reset to default
1

I have a SharePoint 2010 site that has Kerberos auth properly configured and is added to my "Trusted Sites" in Internet Options.

Using KerbTray I get a Kerberos ticket on both Chrome and FireFox. I purged tickets before each attempt.

I then opened SQL Server Management Studio and connected to the SharePoint DB server. I opened a new query window and used the following SQL:

SELECT
    c.session_id
   ,s.login_name
   ,c.auth_scheme
   ,c.net_transport
   ,s.host_name
   ,s.login_time

FROM sys.dm_exec_connections c
INNER JOIN sys.dm_exec_sessions s on s.session_id = c.session_id

I opened FireFox and watched my session authenticate and saw my domain user account hitting the system with Kerberos. I did have to configure FireFox to use Windows Auth, but I am pretty sure recent versions of Chrome automatically use Windows auth and will understand Kerberos just fine. Is your site in "Trusted Sites"? That's all I can think to have you check.

EDIT: I just saw this blog post http://stevehorsfield.wordpress.com/2011/10/09/chrome-almost-supports-sso-in-windows-kerberos-environments/

In DNS are you using a CNAME or an A record for your SharePoint site's domain name?

You can check using nslookup via a command prompt:

C:\Users\Bob>nslookup mail.creideamh.org
Server:  dns-01.domain.local
Address:  192.168.0.2

Non-authoritative answer:
Name:    server.domain.local
Addresses: 192.168.1.203
Aliases:  portal.domain.com

Notice the Name and Alias sections. A CNAME is an alias. You want an A record (Address record).

Improve this answer
3
  • Thanks @Robert! Just downloaded latest ver of Chrome, and Im authenticating as Kerberos now. We were hoping to not have to configure anything for Firefox and instead have it just "work", be it a group policy setting or something else.. but if anything I was worried that it was an IIS issue.. perhaps this is more browser level settings than IIS? I'm not sure if we have a CNAME or A record for our site, what should it be?
    – ewitkows
    Dec 11, 2012 at 20:38
  • If your site's domain name is portal.domain.com then this should be configured in DNS as an A record. I will edit my answer with how to check.
    – Robert Kaucher
    Dec 12, 2012 at 1:10
  • @ewitkows - As far as managing FireFox take a look at the community edition of PolicyPack. Jeremy Moskawitz, group policy MVP, was on RunAsRadio a few weeks back and he mentioned managing FireFox with it. runasradio.com/default.aspx?showNum=292
    – Robert Kaucher
    Dec 12, 2012 at 19:58
2

Enable FireFox Kerberos Trust

Open FireFox

In the Location bar, type about:config, and press enter. The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page.

In the about:config page, search for the preference network.negotiate-auth.trusted-uris, and double-click on it. (this list may not be in alphabetical order) In the prompt that comes up, type a list of servers or domains you want to allow, separated by a comma and a space. Enter the following: yourdomain.com. Click "OK"

You should now be able to access those websites with Kerberos enabled from FireFox without logging in.

Hope this helps.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.