4

I am deploying Linux/Firefox on a corporate Kerberos network.

I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos.

I am using Firefox 3.0.18 on RedHat EL Server 5.5

Here is what I did:

  • Run kinit on the command line to create a Kerberos ticket
  • Check with klist: the ticket is valid until tomorrow, service principal is krbtgt/DC.THECOMPANY.COM@DC.THECOMPANY.COM.
  • In Firefox, set network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris to .dc.thecompany.com.
  • Load the company's portal page via its full hostname: http://server37.thecompany.com/alfresco. (note: server37 is actually the machine I am running Firefox on, but that should not be a problem I guess)

PROBLEM: the company's intranet portal still serves me the login/password page. The same portal correctly uses Kerberos on Internet Explorer/Windows 7 machines, same settings, and shows the user's personal page.

The server does not see any Kerberos request coming.
Did I do something wrong?

I enabled NSPR_LOG_MODULES=negotiateauth:5 as explained here, but the log file stays empty.

1
  • 1
    Note: This question is actually on-topic. "Server Fault is for Information Technology Professionals needing expert answers related to managing computer systems in a professional capacity", in particular "desktop infrastructure" is on-topic. – Nicolas Raoul Jun 25 '12 at 8:43
1

The network.negotiate-auth.trusted-uris should be .thecompany.com or server37.thecompany.com, not .dc.thecompany.com. Your server was not in the list of trusted URI and Firefox never tried to use Negotiate authentication.

For security reasons, I would also enable SSL (HTTPS).

2
  • 1
    Actually, I also tried .thecompany.com (for both variables), and it does not work... – Nicolas Raoul Jun 26 '12 at 4:11
  • Use WireShark or Firebug to see the HTTP headers. Search for the authentication headers. If "Negotiate" is missing this means that the server is not trusted by the browser. – Mircea Vutcovici Jun 26 '12 at 5:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.