[30428] in Kerberos
Re: IE6 Fallback to NTLM
daemon@ATHENA.MIT.EDU (Michael B Allen)
Mon Nov 10 19:39:21 2008
Message-ID: <78c6bd860811101638w7c440319v2f0269ae5fbee7f7@mail.gmail.com>
Date: Mon, 10 Nov 2008 19:38:14 -0500
From: "Michael B Allen" <ioplex@gmail.com>
To: Jobo <jobo@jobo.com>
In-Reply-To: <4918a25e$0$767$58c7af7e@news.kabelfoon.nl>
MIME-Version: 1.0
Content-Disposition: inline
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Mon, Nov 10, 2008 at 4:06 PM, Jobo <jobo@jobo.com> wrote:
> IE (6) and Kerberos
>
> At some (actually one) locations in our network (which is spread all
> over the Netherlands) we have the problem that IE6 randomly falls back
> to NTLM, while FF keeps on working flawlessly.
>
> Does anybody has a clou what is happening? Tickets are valid and
> available, and when a new instance of IE is opened, everything works OK
> again.
>
> The facts:
> Server: SLES 10 + Apache + mod_auth_kerb (Kerberos 5 release 1.4.3)
> Client: IE6 on XP
> Tickets are served by Active Directory.
In the past there have been a few bugs in cache handling on XP:
http://support.microsoft.com/kb/906524
http://support.microsoft.com/kb/885887
Check your kerberos DLLs.
But I haven't seen anyone complain about these sorts of things in a
while so I'm not sure if the bugs described in these KBs are really
relevant anymore.
Note that FF can exhibit different behavior depending on how it's
configured. Note that for some strange reason, FF on Linux actually
requests a service ticket with each HTTP request even though it has a
perfectly good one in the cache. So make sure you're testing FF on
Windows if you want a fair comparison.
Mike
--
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
