Integrated Windows Authentication with Chrome and Firefox

A few days ago, the Powers That Be at my institution rolled out a change to our web authentication scheme. Previously, we were using a proprietary system that somehow played nice with Active Directory. The changed made Active Directory Federation Services play nice with our proprietary system - making ADFS do the real work.

Now, we live in the world of Integrated Windows Authentication.

I'm all for that, mainly because the proprietary system was a PITA in a lot of cases. This new change makes a lot of thing easier. Plus, now logging onto your workstation logs you into our webapps!

Well, not for me. I use a Chrome and Firefox.


Well, not yet anyway ....

It works great for Safari users on a Mac. However, I use Chrome mostly and Firefox for development testing. 

How on earth do I tell Chrome what servers are okay to do Microsoft Integrated Login with?

I guessed there was a way to configure Chrome and Firefox to do this, and it turns out there is! However, it's not straight forward. I fairly quickly found a command-line switch for Chrome:

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --auth-server-whitelist="*<fs-server.whoopie>,<another-fs-server.blurp>"

That would be fine, except I don't open Chrome from the command line; I use Spotlight (<command><space>).

How on earth do I get Chrome to open with that command-line switch by default?

I thought the answers would be in the preference files for Mac: plists. Turns out, preferences in plists are a layered hive of black holes. Values go in, but don't always come out. There's a lot of complexity built in for machine management and group policy. However, I don't have any of that. But, it lead to a lot of dead ends. 

Finally I found this post with an answer: put it in the global preferences! 

I opened /Users/<my-user>/Library/Preferences/.GlobalPreferences.plist with VIM, but it was encrypted in some way. I used plutil to convert it to plain XML:

plutil -convert xml1 .GlobalPreferences.plist

Now I can get to the good stuff. Just added a key/value pair at the top, under the <dict> tag and voilà, everything started working!

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>

        <key>AuthServerWhitelist</key>
        <string><fs-server.whoopie></string>

        <key>AKDeviceUnlockState</key>
        <false/>
        <key>AKLastCheckInAttemptDate</key>
        <date>2017-05-25T14:07:35Z</date>
        ...

I have to say that while this worked, I'm not sure it's the best solution. A more graceful solution is pending free time. Plus that unicorn with which to ride to that magical free-timey land.

As for Firefox, it was easier, but scarier. I found the information I needed here.

In the address bar, I just went to "config:about", then ignored the message about voiding the warrantee. Then, I just needed to put the fully qualified address of the auth server in these keys:

        network.negotiate-auth.trusted-uris
        network.negotiate-auth.delegation-uris
        network.automatic-ntlm-auth.trusted-uris

Close and reopen. Worked great.

Just to be complete, at the time of the writing, I was using Chrome 58 and Firefox 53.

Comments

Post a Comment

Popular posts from this blog

Planned System Downtime

I have some thoughts on planned downtime. Ultimately it boils down to this: is the planned downtime caused by urgent, impending, and guaranteed doom? If yes, then by all means have the downtime whenever you can. If not, affected as few customers as possible, by the numbers. Planned system downtime should minimize impact to system usage - period. By "System Usage" I mean real customers using the system. I recently had a discussion with the systems group about a necessary outage on a system I support. Something important, but not urgent had the possibility to cause downtime on the system. However, if something went wrong and we had to restart a server, the server might not come up. This was deemed as needing pretty serious attention (which I agreed with). They found a fix and wanted to put it into production, as an emergency, planned downtime. We had a downtime window coming up, but this should probably happen before the window. They suggested an evening. Google Anal
Read more

Error Handling

Image
I found this actual error message today while working with a vendor application: Okay, it wasn't that exact error message. And that's my code. BUT, the first part is verbatim. This is a server-side, vendor-provided, and above all, released product. This is not a beta; we paid someone to give us that error message. What am I supposed to do with that message. My code called your code and it told me "Unable to get resources." Guess I'll just take a nap till those resources can be gotten. Over the years I have seen both vendor applications and custom code where programmers are throwing away valuable information by not properly sending errors up the stack.   You should always, always, ALWAYS send your errors up the stack! * The error above could easily have been something like this: See, now I know something! This is a java.lang.NullPointerException exception in the file MeaningfulError.java - on line 11. That's an informativ
Read more