4

I am deploying Linux/Firefox on a corporate Kerberos network.

I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos.

I am using Firefox 3.0.18 on RedHat EL Server 5.5

Here is what I did:

  • Run kinit on the command line to create a Kerberos ticket
  • Check with klist: the ticket is valid until tomorrow, service principal is krbtgt/DC.THECOMPANY.COM@DC.THECOMPANY.COM.
  • In Firefox, set network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris to .dc.thecompany.com.
  • Load the company's portal page via its full hostname: http://server37.thecompany.com/alfresco. (note: server37 is actually the machine I am running Firefox on, but that should not be a problem I guess)

PROBLEM: the company's intranet portal still serves me the login/password page. The same portal correctly uses Kerberos on Internet Explorer/Windows 7 machines, same settings, and shows the user's personal page.

The server does not see any Kerberos request coming.
Did I do something wrong?

I enabled NSPR_LOG_MODULES=negotiateauth:5 as explained here, but the log file stays empty.

closed as too broad by Greg Askew, mdpc, womble Nov 15 '15 at 5:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Note: This question is actually on-topic. "Server Fault is for Information Technology Professionals needing expert answers related to managing computer systems in a professional capacity", in particular "desktop infrastructure" is on-topic. – Nicolas Raoul Jun 25 '12 at 8:43
1

The network.negotiate-auth.trusted-uris should be .thecompany.com or server37.thecompany.com, not .dc.thecompany.com. Your server was not in the list of trusted URI and Firefox never tried to use Negotiate authentication.

For security reasons, I would also enable SSL (HTTPS).

  • 1
    Actually, I also tried .thecompany.com (for both variables), and it does not work... – Nicolas Raoul Jun 26 '12 at 4:11
  • Use WireShark or Firebug to see the HTTP headers. Search for the authentication headers. If "Negotiate" is missing this means that the server is not trusted by the browser. – Mircea Vutcovici Jun 26 '12 at 5:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.