Update: The landscape on OS X has changed since this post was written.

Hugh Cole Baker provided in a comment an excellent mechanism for setting self-managed policy on OS X which beats my clunky wrapper; Lions Kerberos support has changed in a way which prevents SPNEGO working for our Cosign servers (though a fix at our end is planned); Chrome on Linux gained a proper managed configuration, which we use locally (I produced the lcfg-chrome component for this purpose).

Irritated by Firefox 4 beta 7s breakage of SPNEGO on the Mac, but reluctant to revert 3.6, I felt it was time to reinvestigate the alleged Chrome support (note, you can restore SPNEGO to beta 7 by selecting Open in 32-bit mode from the applications Finder properties).

Objective To configure Chromium (or Google Chrome) to authenticate using SPNEGO and Kerberos Background Kerberos is an authentication protocol that supports the concept of Single Sign-On (SSO).

Having authenticated once at the start of a session, users can access network services throughout a Kerberos realm without authenticating again.

Chromium supports SPNEGO, but it is disabled by default for security reasons.

Scenario Suppose you wish to authenticate to the web site using Kerberos.

Method To enable SPNEGO, the URL in question must be whitelisted using the --auth-server-whitelist option when Chromium is started.

Why does NegotiateSPNEGOGSSAPIKerberos not work with the Chrome Browser on Windows or Mac Possible.

An administrator can configure both FORM (username and password) and SPNEGO authentication together, which provides the ability for clients with different security preferences to connect to the same Drill cluster.

Depending on the system, either the administrator or the user configures the client (web browser or web client tool) to use SPNEGO for authentication.

An administrator or a user can follow the steps for configuring the web browser or client tool, such as curl.

By default, this mapping rule extracts the first portion from the provided principal.

For example, if the principal format is realm, the default rule extracts only Name1 from the principal and stores Name1 as the clients identity on server side.

Drill uses the short name, for example Name1, as the user account known to Drill.

This user account name is used to determine if the authenticated user has administrative privileges.

To configure SPNEGO on the client, a Kerberos Ticket Granting Ticket must exist for the user accessing the web server.

The Kerberos Ticket Granting Ticket generated on the client side is used by the web client to get a service ticket from the KDC.

This service ticket is used to generate a SPNEGO token, which is presented to the web server for authentication.

If the server hostname differs, SPNEGO authentication will fail.

For example, to run Chrome from a Linux prompt, run the google-chrome command, as follows.

If the domain is used in auth-server-whitelist, use the domain with Chrome.

If the IP address is used in auth-server-whitelist, use the IP address with Chrome.

Safari automatically authenticates using SPNEGO when requested by the server.

If the client fails to authenticate using SPNEGO, an error page displays with an option to use FORM authentication, assuming FORM authentication is configured on the server side.

Apache and the Apache feather logo are trademarks of The Apache Software Foundation.

Other names appearing on the site may be trademarks of their respective owners.

Configure Chrome For Spengo Mac