Kerberos无法与Chrome一起使用 [英] Kerberos not working with Chrome

问题描述

我有一个托管在IIS 8.5中的.net Web应用程序.该应用程序正在使用SCSM SDK访问Microsoft系统中心服务管理器(SCSM).该站点正在使用Windows身份验证，并且冒充了访问该站点的用户.因此，我遵循了

I have a .net web application that is hosted in IIS 8.5. The application is accessing Microsoft System Center Service Manager (SCSM) using the SCSM SDK. The site is using Windows Authentication and impersonating the user accessing the site. Therefore I have followed this guide to setup Kerberos authentication.

Kerberos运行正常，我能够从SCSM更新和检索数据，并且使用了经过身份验证的用户身份.但是，在测试过程中，我注意到使用Chrome(40.0.2214.115)时使用的身份验证模式为NTLM，因此无法与SCSM交互.

Kerberos is working fine and I am able to update and retrieve data from SCSM and that the authenticated user's identity is used. However, during testing, I am noticing that using Chrome (40.0.2214.115), the authentication mode used is NTLM, thus it fails to interact with SCSM.

IE(11.0.9600.17501)正常工作.

IE (11.0.9600.17501) works fine.

关键:如果我先打开IE并连接到该应用程序，然后再打开Chrome，则它在Chrome中可以正常运行.

The kicker: If I open up IE and connect to the application first, and then open up Chrome, it works fine in Chrome.

大多数用户都在IE上，但是我想了解正在发生的事情，如果可以的话，请予以纠正.

Most of the users are on IE, but I want to understand what is happening and correct it if I can.

我想念什么?

推荐答案

首先:我真正推荐的是使用WireShark(或可能是其他一些网络嗅探器工具)分析线路上的内容.这比以往更多地帮助我跟踪和查找Windows，网络，WCF开发，Kerberos ...等奇怪的问题.要捕获数百个数据包来发现问题并不容易，但是您始终可以将其与已知的好配置进行比较

First: what I can really recommend is to use WireShark (or probably some other network sniffer tool) to analyze what is on the wire. This helped me more than often to trace and find weird problems with Windows, networking, WCF development, Kerberos.... It is not easy with hundreds of captured packets to spot the problem, but you can always compare against a known-good configuration.

对于您的特定问题，建议使用

For your specific problem, I suggest starting Chrome with

--auth-server-whitelist="*example.com"

，如 http://www.chromium.org/developers/design中所述-documents/http身份验证.

这篇关于Kerberos无法与Chrome一起使用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！