CODEWITHSUNDEEP
asp.netgoogle-chromeiiskerberos
Lefka
Lefka

Reputation: 673

Kerberos not working with Chrome

I have a .net web application that is hosted in IIS 8.5. The application is accessing Microsoft System Center Service Manager (SCSM) using the SCSM SDK. The site is using Windows Authentication and impersonating the user accessing the site. Therefore I have followed this guide to setup Kerberos authentication.

Kerberos is working fine and I am able to update and retrieve data from SCSM and that the authenticated user's identity is used. However, during testing, I am noticing that using Chrome (40.0.2214.115), the authentication mode used is NTLM, thus it fails to interact with SCSM.

IE (11.0.9600.17501) works fine.

The kicker: If I open up IE and connect to the application first, and then open up Chrome, it works fine in Chrome.

Most of the users are on IE, but I want to understand what is happening and correct it if I can.

What am I missing?

Upvotes: 1

Views: 10492

Answers (2)

Alex Zhyk
Alex Zhyk

Reputation: 11

Just to complement previous answer: indeed, Chrome requires site to be "whitelisted" and theoretically in Windows it should be picking up values from Internet Options. For me what solved the problem was adding Registry Keys on my Windows 7 computer as follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"AuthNegotiateDelegateWhitelist"="*"

Upvotes: 0

Rainer Schaack
Rainer Schaack

Reputation: 1618

First: what I can really recommend is to use WireShark (or probably some other network sniffer tool) to analyze what is on the wire. This helped me more than often to trace and find weird problems with Windows, networking, WCF development, Kerberos.... It is not easy with hundreds of captured packets to spot the problem, but you can always compare against a known-good configuration.

For your specific problem, I suggest starting Chrome with

--auth-server-whitelist="*example.com"

as described at http://www.chromium.org/developers/design-documents/http-authentication.

Upvotes: 1

Related Questions