Kerberos delegation doesn't work in chrome

问题:

I have an IIS 7 server with 2 sites - site1, site2.

site1 binds port 80, site2 binds port 81.

I have a web page in site2 which sends an http get request via $.ajax() to a URL in site1.

I've configured both site to use kerberos:

1. Enabled only windows authentication, selected only negotiate:kerberos in providers.

2. Configured SPN for the user/server in AD.

I use fiddler to monitor the request headers.

1. When I use IE8, I see that kerberos ticket is delegated from site2 to site1 via 2-hop, the way kerberos should work.

2. When I use chrome, I see that keberos ticket is not delegated. I get an 401 error.

I tried setting:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"AuthNegotiateDelegateWhitelist"="*" 

...(and specifically the server name), but it has not worked.

Any ideas?

回答1:

I had to add the same registry value to this key to make everything work:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chromium

Also interesting to note that I'm using *.domain.local instead of just *.

回答2:

Does the value you entered have the quotes in it?

Try entering * with no quotes.

Shut down Chrome entirely (check task manager to make sure) and then try again.

If you use "*" with the quotes it will not work.