Re: AW: Some Users get Basic Auth?
- From: tstecher@xxxxxxxxx (Todd Stecher)
- Date: Tue, 12 Jun 2007 23:18:20 -0700
On Jun 12, 2007, at 11:04 PM, Djihangiroff, Matthias (KC-DD) wrote:
I've checked the browser settings, Integrated Windows Auth is checked.
Where can i configer the browser, that it use only Kerberos?
I didnt find any option.
You can't. A lot of it depends on the URL you present to IE, which
will in turn dictate what protocol is chosen under SPNEGO.
When you type "http://someserver";, then IE will present the kerberos
package on the client with the service principal name (SPN) of http/
someserver. For kerberos to work, you need a service ticket matching
that SPN. This will only be possible if the web server is properly
registered with a machine account in your client's domain, or
potentially another domain in the forest (assuming you're using AD).
In some cases, IE will do a reverse lookup and expand the someserver
to http/someserver.domain.com, but the SPN lookup rule still applies.
If kerberos can't find the SPN (for example if the target server
isn't registered in a trusted domain, or the client's KDC can't be
reached over the presently connected network), it will drop back to
NTLM (wrapped in SPNEGO tokens). There's really no easy way to
guarantee Kerberos, and, in fact, NTLM is frequently the protocol
chosen for http auth.
We tried, in the old days to get rid of NTLM, but that's not possible
w/o service interruptions unless you can *always* get a service
ticket to the server.
Todd
________________________________________________
Kerberos mailing list Kerberos@xxxxxxx
https://mailman.mit.edu/mailman/listinfo/kerberos
.
- Follow-Ups:
- AW: AW: Some Users get Basic Auth?
- From: "Djihangiroff, Matthias (KC-DD)"
- AW: AW: Some Users get Basic Auth?
- From: Djihangiroff, Matthias (KC-DD)
- AW: AW: Some Users get Basic Auth?
- References:
- AW: Some Users get Basic Auth?
- From: "Djihangiroff, Matthias (KC-DD)"
- AW: Some Users get Basic Auth?
- Prev by Date: Re: AW: Some Users get Basic Auth?
- Next by Date: AW: AW: Some Users get Basic Auth?
- Previous by thread: Re: AW: Some Users get Basic Auth?
- Next by thread: AW: AW: Some Users get Basic Auth?
- Index(es):
Relevant Pages
|
