Google Chrome: passthrough Windows authentication

Question

The I.T. dept is considering allowing installation and automated deployment of Google Chrome browser to 100+ desktops. One of the requirements is for domain credentials to be passed through. The desired behaviour is the same as Internet Explorer.

An issue has come up when browsing intranet resources. Intranet sites which require Active Directory authentication are showing the "Authentication Required" dialog.

For each site, you have to enter your domain credentials.

Question: Does Google Chrome currently, or plan to, support passthrough Windows authentication? If so, how do you configure this security setting?

Answer 1

According to the Google Issues list for Chromium, this issue was reported in Sep 2008. The NTLM passthrough feature has been given to the Google Summer of Code team. It sounds like it will be worked on in Summer 2009 at the Google Summer of Code.

This is good news, and will hopefully bring some stature to Chrome's image in the enterprise. The intranet is so prevalent, and to adopt a browser is difficult without having this feature.

Update

This has been included in the stable release of Chrome 5.x as of May 2010. It works similar to Internet Explorer in that "Intranet" URLs (without dots in the address) will attempt single sign-on if requested by the server.

Answer 2

I can't tell you about whether it's planned or not, but it's not there in the current version.

It's based on an open-source browser, Chromium. If you want such a feature you can pay somebody to add it.

Answer 3

This is not included in Google Chrome; however, you could try running a local proxy service which supports NTLM. This would need to be installed on each desktop and Chrome would need to be configured to utilize the proxy.

NTLM Authorization Proxy Server

Cntlm Authentication Proxy

Answer 4

Here is the configuration for the NTLM whitelist:

chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz"

Found this example here: https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication

Answer 5

Chrome now has passthrough Windows authentication that will work on any host without a domain. If you use domains on all intranet site you'll need to use the --auth-server-whitelist command line option.

Answer 6

I suppose it is OK for the Chrome team to leave this out if they are not going after the corporate market.

Answer 7

Chrome has been updated (version 5+) has the following:
In windows it integrates with intranet zones setting in 'internet options'

In Windows only, if the command-line switch is not present, the permitted list consists of those servers in the Local Machine or Local Intranet security zone (for example, when the host in the URL includes a "." character it is outside the Local Intranet security zone), which is the behavior present in IE.

If a challenge comes from a server outside of the permitted list, the user will need to enter the username and password.

For other OS's, you can use the command line switch:

--auth-server-whitelist="*example.com,*foobar.com,*baz"

source: https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication