Re: AW: Some Users get Basic Auth?


On Jun 12, 2007, at 11:04 PM, Djihangiroff, Matthias (KC-DD) wrote:

I've checked the browser settings, Integrated Windows Auth is checked.

Where can i configer the browser, that it use only Kerberos?
I didnt find any option.

You can't. A lot of it depends on the URL you present to IE, which will in turn dictate what protocol is chosen under SPNEGO.

When you type "http://someserver";, then IE will present the kerberos package on the client with the service principal name (SPN) of http/ someserver. For kerberos to work, you need a service ticket matching that SPN. This will only be possible if the web server is properly registered with a machine account in your client's domain, or potentially another domain in the forest (assuming you're using AD).

In some cases, IE will do a reverse lookup and expand the someserver to http/someserver.domain.com, but the SPN lookup rule still applies.

If kerberos can't find the SPN (for example if the target server isn't registered in a trusted domain, or the client's KDC can't be reached over the presently connected network), it will drop back to NTLM (wrapped in SPNEGO tokens). There's really no easy way to guarantee Kerberos, and, in fact, NTLM is frequently the protocol chosen for http auth.

We tried, in the old days to get rid of NTLM, but that's not possible w/o service interruptions unless you can *always* get a service ticket to the server.

Todd
.

Relevant Pages

  • Re: Kerberos Authentication to VWMare...
    ... A Kerberos Error Message was received: ... Server Realm: ... We have checked the SPN using SetSPN with -L option and see that both MOSS ...
    (microsoft.public.windows.server.security)
  • Re: Delegation: IIS Server setup in typical 3-tier scenario.
    ... doesn't already have an SPN and/or you need to change the existing SPN. ... Kerberos is being used - it just means that an API is used to determine what ... so I'm trying to set up delegation. ... Authenticated using NTLM not Kerberos on the Web Server. ...
    (microsoft.public.inetserver.iis.security)
  • kerberos TGS for an IP address
    ... Vista never uses kerberos for servers which name is specified by an IP address, is that right? ... By using the work ASKS I would like to stress the fact XP always asks for a TGS, which may not be available because of an appropriate SPN is missing. ...
    (microsoft.public.windows.vista.security)
  • Re: kerberos logon to IP address
    ... So we are going to create SPN and enable kerberos for the alias. ... the Vista client not even asks for TGT - once again as observed by using Wireshark ...
    (microsoft.public.windows.vista.security)
  • Re: Kerberos w/ SQL and WIN2000
    ... Seems that you do require an SPN in order for a client to ... errors in the system log of the client (with Kerberos logging ... >> I've recently been doing some work with Kerberos and SQL for ...
    (microsoft.public.sqlserver.security)