CODEWITHSUNDEEP
securitygoogle-chromeiis-7kerberos
user1997656
user1997656

Reputation: 532

Kerberos delegation doesn't work in chrome

I have an IIS 7 server with 2 sites - site1, site2.

site1 binds port 80, site2 binds port 81.

I have a web page in site2 which sends an http get request via $.ajax() to a URL in site1.

I've configured both site to use kerberos:

  1. Enabled only windows authentication, selected only negotiate:kerberos in providers.

  2. Configured SPN for the user/server in AD.

I use fiddler to monitor the request headers.

  1. When I use IE8, I see that kerberos ticket is delegated from site2 to site1 via 2-hop, the way kerberos should work.

  2. When I use chrome, I see that keberos ticket is not delegated. I get an 401 error.

I tried setting:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"AuthNegotiateDelegateWhitelist"="*"

...(and specifically the server name), but it has not worked.

Any ideas?

Upvotes: 11

Views: 14845

Answers (5)

Andre
Andre

Reputation: 108

Just ran into this in 2022. Chrome changed the registry keys, what was Whitelist is no Allowlist. WhiteList no longer used

https://support.google.com/chrome/a/answer/7679408#noNonIncl

Upvotes: 1

user7936328
user7936328

Reputation: 1

It worked only after I added AuthServerWhitelist key in qouple with AuthNegotiateDelegateWhitelist key.

My registry script now looks like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] 
"AuthServerWhitelist"="*"
"AuthNegotiateDelegateWhitelist"="*"

Upvotes: 0

Ewan
Ewan

Reputation: 1087

Given we now have Edge Chromium. Running the registry script below will fix for both browsers

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge] "AuthNegotiateDelegateAllowlist"="*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "AuthNegotiateDelegateWhitelist"="*"

I extracted both keys from my registry where they have no quotes around * in the registry, however the extracted keys look exactly as I have Posted above

Upvotes: 0

stames
stames

Reputation: 1260

I had to add the same registry value to this key to make everything work:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chromium

Also interesting to note that I'm using *.domain.local instead of just *.

Upvotes: 2

kralco626
kralco626

Reputation: 8654

Does the value you entered have the quotes in it?

Try entering * with no quotes.

Shut down Chrome entirely (check task manager to make sure) and then try again.

If you use "*" with the quotes it will not work.

Upvotes: 0

Related Questions