Integrated Windows Authentication with Chrome and FireFox

firefoxgoogle-chromewindows-authentication

I have a webapplication which uses claims based authentication. The STS is ADFS 2.0.
When I am in the intranet and use IE, IWA is used and no login dialog appears. When I am on the internet zone, the Forms based authentication of ADFS is used. Just what I want.

Chrome and FireFox are also working as expected when I am in the internet zone.
But when I am in the intranet zone, both come with a login dialog, instead of using IWA.
And supplying my credentials in that dialog does not work, it keeps repeating the dialog.

Any hints?

UPDATE: Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords.
Here the answer: https://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using

Best Answer

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: https://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using

Related Solutions

Google Chrome – Passthrough Windows Authentication

This has been included in the stable release of Chrome 5.x as of May 2010. It works similar to Internet Explorer in that "Intranet" URLs (without dots in the address) will attempt single sign-on if requested by the server.

To enable passthrough for other domains, you need to run Chrome with an extra command line parameter:

chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz"

Background

According to the Google Issues list for Chromium, this issue was reported in Sep 2008. The NTLM passthrough feature was apparently given to the Google Summer of Code team. It sounds like it will be worked on in Summer 2009 at the Google Summer of Code.

This is good news, and will hopefully bring some stature to Chrome's image in the enterprise. The intranet is so prevalent, and to adopt a browser is difficult without having this feature.

IIS, SQLServer, Google Chrome and Windows Authentication

Your problem is that you are using chromium documentation to solve a chrome problem. While similar, they are two different browsers. You need to enable delegation by white-listing the servers that IIS can delegate to. The way that you do it in Chrome is similar to chromium but in the case of the registry keys you need to use [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] for chrome instead of [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chromium] for chromium.

When you read the doc, you will find that you can user Group Policy, Chrome for Business or the command line to enable delegation, but in your setting, I assume that you used the registry option. I find that the essential key to set is AuthNegotiateDelegateWhitelist. Set the Value to "*" to start. Once you have it working, lock it down to just the servers you want by changing the * to a comma separated list of servers, either by IP address or DNS name. Wild cards are allowed. You may want to look at the AuthServerWhiteList key as well.

Best Answer

Related Solutions

Google Chrome – Passthrough Windows Authentication

IIS, SQLServer, Google Chrome and Windows Authentication

Related Topic