4

I am deploying Linux/Firefox on a corporate Kerberos network.

I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos.

I am using Firefox 3.0.18 on RedHat EL Server 5.5

Here is what I did:

  • Run kinit on the command line to create a Kerberos ticket
  • Check with klist: the ticket is valid until tomorrow, service principal is krbtgt/DC.THECOMPANY.COM@DC.THECOMPANY.COM.
  • In Firefox, set network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris to .dc.thecompany.com.
  • Load the company's portal page via its full hostname: http://server37.thecompany.com/alfresco. (note: server37 is actually the machine I am running Firefox on, but that should not be a problem I guess)

PROBLEM: the company's intranet portal still serves me the login/password page. The same portal correctly uses Kerberos on Internet Explorer/Windows 7 machines, same settings, and shows the user's personal page.

The server does not see any Kerberos request coming.
Did I do something wrong?

I enabled NSPR_LOG_MODULES=negotiateauth:5 as explained here, but the log file stays empty.

Nicolas Raoul
  • 1,334
  • 7
  • 22
  • 43
  • 1
    Note: This question is actually on-topic. "Server Fault is for Information Technology Professionals needing expert answers related to managing computer systems in a professional capacity", in particular "desktop infrastructure" is on-topic. – Nicolas Raoul Jun 25 '12 at 08:43

1 Answers1

1

The network.negotiate-auth.trusted-uris should be .thecompany.com or server37.thecompany.com, not .dc.thecompany.com. Your server was not in the list of trusted URI and Firefox never tried to use Negotiate authentication.

For security reasons, I would also enable SSL (HTTPS).

Mircea Vutcovici
  • 17,619
  • 4
  • 56
  • 83
  • 1
    Actually, I also tried `.thecompany.com` (for both variables), and it does not work... – Nicolas Raoul Jun 26 '12 at 04:11
  • Use WireShark or Firebug to see the HTTP headers. Search for the authentication headers. If "Negotiate" is missing this means that the server is not trusted by the browser. – Mircea Vutcovici Jun 26 '12 at 05:40