Kerberos and fallback to BasicAuth with windows Chrome/Edge which are not in the domain.

[winnuker]

Hello,

is anyone using kerberos and successful fallback to BasicAuth with windows Chrome/Edge (80+) which are not in the domain?

In my setup all browsers on windows in the domain are working flawless.
From outside the domain Firefox on windows, ChromeOS, Chrome on Android ares falling back to BasicAuth and the login works fine.

Only windows Chrome/Edge clients from outside the domain do not fall back to BasicAuth. This is the ErrorMessage:
GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

The Server is CentOS 8.3 with mod_auth_gssapi-1.6.1-6.el8.x86_64

[simo5]

What's your configuration?
I assume Edge is trying to fallback to NTLMSSP and failing that decides to stop authenticating.

[winnuker]

Here is the configuration:

<Location />
 AuthType GSSAPI
 AuthName "web07-rz"
 GssapiCredStore  keytab:/etc/httpd/conf.d/web07-rz_http.keytab
 GssapiAllowedMech      krb5
 GssapiBasicAuthMech    krb5
 GssapiBasicAuth On
 GssapiSSLonly On
 GssapiUseSessions On
 Session On
 SessionCookieName gssapi_session path=/private;httponly;secure;
 GssapiLocalName on
 <RequireAny>
  AuthLDAPBindDN "CN=ldap_user,OU=IT,DC=example,DC=com"
  AuthLDAPBindPassword "*********"
  AuthLDAPURL "ldaps://dc01.example.com dc02.example.com/DC=example,DC=com?sAMAccountName?sub?(objectClass=*)" SSL
  Require ldap-group CN=web_allow, OU=IT, DC=example, DC=com
 </RequireAny>
</Location>

[simo5]

I think this confirms my thinking, NTLMSSP is not allowed as a mechanism, therefore if the Windows client tries to use it you would get a message about an unsupported mechanism.
I do not know how to fix this for Edge, unless you can find an example of an ISS server that can do Basic Auth and there is documentation or a network capture that shows if any special messaging or header is needed for Edge to allow the fallback.

[simo5]

Note that in general my recommendation is to not enable Basic Auth, and instead implement a handler for 401 pages that shows a form based authentication page that can take a clear text password and perform authentication in the backend.

[simo5]

In theory this page can be built such that it performs basic auth against a local only (private) mod_auth_gssapi protected page that allows basic auth.
And then forward back the cookie to the original requestor.

[winnuker]

Thank you for your advice.
The old Server was an CentOS6 with mod_auth_kerb.
The fallback worked there without problems.

In the moment i am using a workaround with an If Else section in the apache config:

<If "-R '1.2.3.4/24' || -R '192.168.0.0/16' || -R '172.16.0.0/12' || -R '10.0.0.0/8'">
  # do nothing
</If>
<Else>
  BrowserMatch Windows gssapi-no-negotiate
</Else>

[simo5]

Thank you for your advice.
The old Server was an CentOS6 with mod_auth_kerb.
The fallback worked there without problems.

This is interesting, would you be able to capture a trace of the headers in the HTTP request with a test account and send them to me (or attach them here) so I can see what is the difference with the old setup on the wire?

If I can find a clue I can see if I can provide support for a tweak that makes it work similarly. (unless the tweak is gross, requires raw krb5 usage, or is unsafe).