[24661] in Kerberos
Re: Internet Explorer is using NTLM insted of Kerberos
daemon@ATHENA.MIT.EDU (Kent Wu)
Mon Sep 19 13:41:19 2005
From: Kent Wu <kwu@xsigo.com>
To: Eitan <noyasoft@netvision.net.il>
In-Reply-To: <1126828156.655914.300750@g49g2000cwa.googlegroups.com>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Date: Mon, 19 Sep 2005 10:29:59 -0700
Message-Id: <1127150999.21470.153.camel@jurassic.mvcorp.xsigo.com>
Mime-Version: 1.0
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
My experience is that IE has never used kerberos, it's always been NTLM
even though AD understands both Kerberos and NTLM (through SPNEGO).
Hope this helps.
-Kent
On Thu, 2005-09-15 at 16:49 -0700, Eitan wrote:
> Hi,
> Not sure if this is the correct place to post this question so I'm
> sorry if it's not.
>
> I've created in a test environment the following configuration:
> - PC A: Running Windows 2003 as active directory domain controller.
> - PC B: Windows XP Pro (that was added to the AD) logged on to the AD.
> - PC C: Simply running a sniffer.
>
> Now..
> Having read this :
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/6291dce1-4ea8-4b4f-a9c1-23926ab6e8dd.mspx
>
> I fixed what was stated in this article (added the AD server to the
> correct zone on the XP client, and made sure that the Integrated logon
> was checked)
> After this setup I was ready to start the browser and post a request
> for a simple "Hello world" page on the AD server (and yes , the URL was
> constructed with the FQDN of the Ad and not it's IP)
>
> When the TCP stream was decoded by the sniffer I found that the server
> sent a single "Authorization" header to the client stating "Negotiate"
> and the client sent an NTLM keys (decoded into "NTLMSSP" string)
> no mater what I tried I keep getting those NTLM sessions and no
> Kerberos.
>
> Eitan.
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--
Kent Wu <kwu@xsigo.com>
XSIGO INC.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
