Kerberos 委托在 chrome 中不起作用 [英] Kerberos delegation doesn't work in chrome

问题描述

I have an IIS 7 server with 2 sites - site1, site2.

site1 binds port 80, site2 binds port 81.

I have a web page in site2 which sends an http get request via $.ajax() to a URL in site1.

I've configured both site to use kerberos:

1. Enabled only windows authentication, selected only negotiate:kerberos in providers.

2. Configured SPN for the user/server in AD.

I use fiddler to monitor the request headers.

1. When I use IE8, I see that kerberos ticket is delegated from site2 to site1 via 2-hop, the way kerberos should work.

2. When I use chrome, I see that keberos ticket is not delegated. I get an 401 error.

I tried setting:

[HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChrome]
"AuthNegotiateDelegateWhitelist"="*" 

...(and specifically the server name), but it has not worked.

Any ideas?

解决方案

I had to add the same registry value to this key to make everything work:

HKEY_LOCAL_MACHINESOFTWAREPoliciesChromium

Also interesting to note that I'm using *.domain.local instead of just *.

这篇关于Kerberos 委托在 chrome 中不起作用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！