IIS/AD – Implementing single sign-on between two websites

This has been included in the stable release of Chrome 5.x as of May 2010. It works similar to Internet Explorer in that "Intranet" URLs (without dots in the address) will attempt single sign-on if requested by the server.

To enable passthrough for other domains, you need to run Chrome with an extra command line parameter:

chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz"

Background

According to the Google Issues list for Chromium, this issue was reported in Sep 2008. The NTLM passthrough feature was apparently given to the Google Summer of Code team. It sounds like it will be worked on in Summer 2009 at the Google Summer of Code.

This is good news, and will hopefully bring some stature to Chrome's image in the enterprise. The intranet is so prevalent, and to adopt a browser is difficult without having this feature.

Troubleshooting permissions problems can be a challenge but at the end of the day here's what I think:

The users are able to access the directories regardless of their membership in the groups you've created because the users are members of the local users group, which has access to the directories. For the most part, permissions are cumulative and the least restrictive permissions apply except in cases of explicitly defined permissions (Allow or Deny). In order to achieve your desired restrictions you have two choices:

1. Do what you've already done and define an explicit Deny on the directories to the groups that you don't want to have access.

2. Remove permissions inheritance from the directories, remove the local users group from the permissions on the directories and define an explicit Allow on the directories to the groups that you do want to have access.