[24533] in Kerberos
Re: windows browsers send ntlm instead of kerberos tokens
daemon@ATHENA.MIT.EDU (vadim)
Sat Aug 27 06:41:00 2005
From: vadim <vadim.tarassov@swissonline.ch>
To: Julien ALLANOS <julien.allanos@aql.fr>
In-Reply-To: <20050826172317.ta37izpe744kosc8@webmail.aql.fr>
Content-Type: text/plain
Date: Sat, 27 Aug 2005 12:39:45 +0200
Message-Id: <1125139185.4049.5.camel@vadim>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Probably silly question ... Have you enabled "windows integrated
authentication" in IE? Is your http server in the "trusted zone"?
best regards, vadim tarassov.
On Fri, 2005-08-26 at 17:23 +0200, Julien ALLANOS wrote:
> Quoting Jeffrey Altman <jaltman2@nyc.rr.com>:
>
> > Julien ALLANOS wrote:
> >
> >> Quoting Jeffrey Altman <jaltman2@nyc.rr.com>:
> >>
> >>> Neither Internet Explorer nor FireFox 1.0 use KFW for their Kerberos
> >>> support. If you want them to have Kerberos credentials, Windows must
> >>> obtain them for you when you login to Windows using an Active Directory
> >>> account.
> >>>
> >>> Jeffrey Altman
> >>
> >>
> >> OK, but how can I be certain that Windows did really obtain the Kerberos
> >> credentials at login, that FF or IE might be able to use after?
> >
> > Since you have MIT KFW installed you can list the contents of the
> > MSLSA ccache with
> >
> > klist -c MSLSA:
> >
> > Otherwise, you can install one of the Microsoft tools such as
> > kerbtray.exe that are available from the Microsoft download web site.
> >
>
> Thanks.
>
> Both klist -c MSLSA: and kerbtray tell me that the following tickets are given
> to me at login (verified by purging, logout and login again):
>
> * krbtgt/MY.DOMAIN.TLD@MY.DOMAIN.TLD
> * ldap/host.my.domain.tld/my.domain.tld@MY.DOMAIN.TLD
> * host/host.my.domain.tld@MY.DOMAIN.TLD
>
> However, IE or FF are still sending NTLM tickets. Any clue?
--
vadim <vadim.tarassov@swissonline.ch>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
