iis - Internet explorer sending kerberos tickets with every request, even when persist-auth is enabled -


i have intranet site hosted iis 7 windows authentication, configured accept negotiate. set configuration setting use per-connection kerberos (non-ntlm) authentication:

 <system.webserver>    <security>      <authentication>        <windowsauthentication authpersistnonntlm="true" />      </authentication>    </security>  </system.webserver>

now chrome correctly authenticates once kerberos ticket, , not send authorization headers on subsequent requests.

internet explorer send large kerberos ticket every request. server sending correct persist-auth: true header. ie should know not bother pre-authenticating. behavior can observed in @ least ie9 , ie10 on windows 7 64bit.

is there other reason behavior? way fix it?

also please note using kernel mode on iis7 , no virtual directory security.

if have ie9/ie10 connect ntlm not pre-authenticate (which correct behavior).

i'm hoping there magical header can manually add server responses ie behave correctly ...

you didn't mention kind of url using intranet site - did use hostname or dns alias? short (netbios) name or qualified? notice same behavior when using these different types of urls? did check if headers in fiddler kerberos, or if spnego falling ntlm?

fiddler behaves proxy server; can intercept traffic because registers wininet proxy. cnames , proxies interact in complicated manner kerberos, can make hard see going on. cname, ie create kerberos ticket request hostname instead. adding proxy in mix further change behavior. if issue experiencing, specific microsoft products, why found modern browsers work correctly.

you did right thing doing wire trace, because troubleshooting kerberos proxy not idea.


Comments

  1. Goodnews4 March 2023 at 04:09

    I’m impressed, I must say.
    Rarely do I come across a blog that’s both educative and engaging, and without a doubt, you’ve hit the nail on the head. The problem is an issue that not enough people are speaking intelligently about. I’m very happy that I found this during my search for something regarding this. I would like you to check out my own blog which best explains more about AFWA Research Scholarships For Africa Students.
    So read through carefully to be enlightened.

    ReplyDelete

Post a Comment

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

i've tried various ways coerce xterm (versions 285 , 292) copy selection clipboard clipboard whenever press ctrl-shift-c. promising way far has been, in ~/.xresources, put this: xterm*vt100.translations: #override \ ctrl shift <keypress> c: copy-selection(clipboard) \n\ ctrl shift <keypress> v: insert-selection(clipboard) ctrl-shift-v works perfectly, copying has nuance... if restart xterm, highlighting text puts things in primary clipboard; expected, proper, default behavior. if hit ctrl-shift-c, copies current selection clipboard clipboard. the bug, however, if highlight text after first time pressed ctrl-shift-c, you'll see highlighting copies both primary and clipboard. cannot figure out how stop xterm updating clipboard upon selection... , doesn't make sense me in first place. i said, @ specific point in time, copy selection clipboard... yet starts updating automatically upon selection after doing once... anyone have workaround...
Read more

qt - Errors in generated MOC files for QT5 from cmake -

i generated moc files qt5 using set (cmake_automoc on) set(cmake_include_current_dir on) then add moc files src using set(src src/main.cpp src/video_widget_surface.cpp src/video_widget.cpp src/video_player.cpp #moc files moc/moc_video_player.cpp moc/moc_video_widget.cpp moc/moc_video_widget_surface.cpp finally add executable using add_executable(somegui ${src}) but errors in moc files saying : /other/workspace/perception/somestuff/moc/moc_video_widget.cpp:54:6: error: 'videowidget' has not been declared /other/workspace/perception/somestuff/moc/moc_video_widget.cpp:62:19: error: 'videowidget' has not been declared /other/workspace/perception/somestuff/moc/moc_video_widget.cpp:68:20: error: 'videowidget' has not been declared /other/workspace/perception/somestuff/moc/moc_video_widget.cpp:68:46: error: non-member function 'const qmetaobject* metaobject()' cannot have cv-qualifier /other/qt5.0.1/5.0.1/gcc_64/include/qtcore/qo...
Read more