28

The I.T. dept is considering allowing installation and automated deployment of Google Chrome browser to 100+ desktops. One of the requirements is for domain credentials to be passed through. The desired behaviour is the same as Internet Explorer.

An issue has come up when browsing intranet resources. Intranet sites which require Active Directory authentication are showing the "Authentication Required" dialog.

For each site, you have to enter your domain credentials.

Question: Does Google Chrome currently, or plan to, support passthrough Windows authentication? If so, how do you configure this security setting?

Improve this question
1
  • The right answer for this has changed over the years. For quite some time now Chrome has been capable of paying attention to the system's native Internet Settings from the control panel and emulate IE's behavior, which is immeasurably more useful than setting a commandline option or GPO setting. See @Myster's answer below.
    – Tomalak
    Apr 5, 2018 at 9:23

6 Answers 6

Reset to default
18

This has been included in the stable release of Chrome 5.x as of May 2010. It works similar to Internet Explorer in that "Intranet" URLs (without dots in the address) will attempt single sign-on if requested by the server.

To enable passthrough for other domains, you need to run Chrome with an extra command line parameter:

chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz"

Background

According to the Google Issues list for Chromium, this issue was reported in Sep 2008. The NTLM passthrough feature was apparently given to the Google Summer of Code team. It sounds like it will be worked on in Summer 2009 at the Google Summer of Code.

This is good news, and will hopefully bring some stature to Chrome's image in the enterprise. The intranet is so prevalent, and to adopt a browser is difficult without having this feature.

Improve this answer
7

You configure the NTLM whitelist by launching Chrome with this additional parameter: 

chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz"

Source:
https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication

Improve this answer
1
  • Path to exe C:\Program Files (x86)\Google\Chrome\Application
    – Lord Darth Vader
    Jul 5, 2018 at 8:56
5

Chrome has been updated (version 5+) has the following:
In windows it integrates with intranet zones setting in 'internet options'

In Windows only, if the command-line switch is not present, the permitted list consists of those servers in the Local Machine or Local Intranet security zone (for example, when the host in the URL includes a "." character it is outside the Local Intranet security zone), which is the behavior present in IE.

If a challenge comes from a server outside of the permitted list, the user will need to enter the username and password.

For other OS's, you can use the command line switch: 

--auth-server-whitelist="*example.com,*foobar.com,*baz"

source: https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication

Improve this answer
1
  • Does that mean that if you add an extra domain to the "Local Intranet Security Zone" in IE that Chrome will also trust it too?
    – Simon East
    Jul 24, 2015 at 1:23
4

Chrome now has passthrough Windows authentication that will work on any host without a domain. If you use domains on all intranet site you'll need to use the --auth-server-whitelist command line option.

Improve this answer
1
  • 1
    how does this command line option work? Does the Chrome shortcut need to be modified to include this option, or is this set in the about: page or other config page?
    – p.campbell
    Mar 11, 2011 at 21:00
3

This is not included in Google Chrome; however, you could try running a local proxy service which supports NTLM. This would need to be installed on each desktop and Chrome would need to be configured to utilize the proxy.

NTLM Authorization Proxy Server

Cntlm Authentication Proxy

Improve this answer
1
  • Wouldn't Negotiate be better? Even Microsoft recommends using it over NTLM.
    – u1686_grawity
    Jun 4, 2009 at 18:37
2

I can't tell you about whether it's planned or not, but it's not there in the current version.

It's based on an open-source browser, Chromium. If you want such a feature you can pay somebody to add it.

Improve this answer
6
  • 1
    Or add it yourself.
    – u1686_grawity
    Jun 4, 2009 at 18:38
  • 1
    Heh heh... either way, you're paying for it somehow. Your money or your time. smile To wax philosophically for a second: This is why I love open source software. You actually have a way to control the features and can create your own destiny. When I've explained open source to people who thought of it like "communism" as "you're free to contract with any qualified party to work on the software" I've often found that attitudes change.
    – Evan Anderson
    Jun 4, 2009 at 18:53
  • This comment is way out of date now.
    – Simon East
    Jul 24, 2015 at 0:07
  • @SimonEast - I'm going to assume you're referring to my answer (my 77th, ever), and not my comment re: "communism". re: the answer - That's absolutely true-- as are a lot of answers across all the Stack Exchange sites. I'd presume that having a date stamped on my answer makes readers painfully aware that the information is likely out of date. I don't, personally, see it as a productive activity to spend time searching for 6+ year old answers that are already low on vote counts ( as compared to the accepted answer) and downvoting them but if that makes you happy please feel free.
    – Evan Anderson
    Jul 24, 2015 at 0:53
  • Yes, sorry I was referring to your answer, not your comment. And downvoting obsolete answers is encouraged, especially if there are others that should have more visibility. Feel free to delete or improve your answer if you don't want the downvotes.
    – Simon East
    Jul 24, 2015 at 1:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .