Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am deploying Linux/Firefox on a corporate Kerberos network.

I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos.

I am using Firefox 3.0.18 on RedHat EL Server 5.5

Here is what I did:

  • Run kinit on the command line to create a Kerberos ticket
  • Check with klist: the ticket is valid until tomorrow, service principal is krbtgt/DC.THECOMPANY.COM@DC.THECOMPANY.COM.
  • In Firefox, set network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris to .dc.thecompany.com.
  • Load the company's portal page via its full hostname: http://server37.thecompany.com/alfresco. (note: server37 is actually the machine I am running Firefox on, but that should not be a problem I guess)

PROBLEM: the company's intranet portal still serves me the login/password page. The same portal correctly uses Kerberos on Internet Explorer/Windows 7 machines, same settings, and shows the user's personal page.

The server does not see any Kerberos request coming.
Did I do something wrong?

I enabled NSPR_LOG_MODULES=negotiateauth:5 as explained here, but the log file stays empty.

share|improve this question
    
Note: This question is actually on-topic. "Server Fault is for Information Technology Professionals needing expert answers related to managing computer systems in a professional capacity", in particular "desktop infrastructure" is on-topic. –  Nicolas Raoul Jun 25 '12 at 8:43
add comment

1 Answer

The network.negotiate-auth.trusted-uris should be .thecompany.com or server37.thecompany.com, not .dc.thecompany.com. Your server was not in the list of trusted URI and Firefox never tried to use Negotiate authentication.

For security reasons, I would also enable SSL (HTTPS).

share|improve this answer
    
Actually, I also tried .thecompany.com (for both variables), and it does not work... –  Nicolas Raoul Jun 26 '12 at 4:11
    
Use WireShark or Firebug to see the HTTP headers. Search for the authentication headers. If "Negotiate" is missing this means that the server is not trusted by the browser. –  Mircea Vutcovici Jun 26 '12 at 5:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.