12:59 p.m.
Hello!
Having only used it once...it's fair to say I'm a relatively new FreeIPA user.
I'm seeing undesirable behavior that I am unsure of how to disable.
Any time I use a browser to connect to the FreeIPA server, I see a Basic Auth prompt
challenging me for username/password. I have to click cancel twice, then I see the
forms-based login prompt - which is what I want to see by default.
Interestingly enough, I do not see the basic auth prompt when using Firefox. It only seems
to happen with Chromium-based browsers.
I've tried searching for info on how to disable the basic auth prompt, but have not
found anything as of yet.
Would someone please provide some guidance?
Thanks in advance!
Best Regards,
-JeffH
3:43 a.m.
New subject: Eliminating Basic Auth Prompt When Accessing FreeIPA Direct
On 17/05/2023 18:59, Jeff Hochberg via FreeIPA-users wrote:
Hello!
Having only used it once...it's fair to say I'm a relatively new FreeIPA user.
I'm seeing undesirable behavior that I am unsure of how to disable.
Any time I use a browser to connect to the FreeIPA server, I see a Basic Auth prompt
challenging me for username/password. I have to click cancel twice, then I see the
forms-based login prompt - which is what I want to see by default.
Interestingly enough, I do not see the basic auth prompt when using Firefox. It only
seems to happen with Chromium-based browsers.
I've tried searching for info on how to disable the basic auth prompt, but have not
found anything as of yet.
Would someone please provide some guidance?
Thanks in advance!
Best Regards,
-JeffH
According to <https://pagure.io/freeipa/issue/8591> there's a workaround
that can be applied to disable this prompt. The BrowserMatch directive
can be applied server-side, so I just created
/etc/httpd/conf.d/no-login-popup.conf with the contents:
# https://pagure.io/freeipa/issue/8591
BrowserMatch Windows gssapi-no-negotiate
... and that has banished the login prompt.
Any thoughts on whether this could be added to the default IPA server
configuration?
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
12:34 p.m.
New subject: Eliminating Basic Auth Prompt When Accessing FreeIPA Direct
Amazing!
I decided to try both your suggested fix as well as the fix suggested in one of the linked
posts - both worked.
Your fix:
1. Create /etc/httpd/conf.d/no-login-popup.conf
2. Add the following text:
BrowserMatch Windows gssapi-no-negotiate
3, Save and restart httpd
I also tested the proposed fix in this post:
https://jdshewey.blogspot.com/2017/08/fixing-annoying-popup-in-freeipa.html
1. Edited /etc/httpd/conf.d/ipa-rewrite.conf
2. Added the following to the bottom of the file:
#The following disables the annoying kerberos popup for Chrome
RewriteCond %{HTTP_COOKIE} !ipa_session
RewriteCond %{HTTP_REFERER} ^(.+)/ipa/ui/$
RewriteRule ^/ipa/session/json$ - [R=401,L]
RedirectMatch 401 ^/ipa/session/login_kerberos
3, Restarted httpd
I agree with you - I'd have to think others run into this as well. At the very least,
there should be an option to enable/disable this in the FreeIPA dashboard.
Thanks for the assistance!!!
4:17 a.m.
New subject: Eliminating Basic Auth Prompt When Accessing FreeIPA Direct
For some extra context. This has to do with "Negotiate" authentication.
It is there to allow single sign on via Kerberos. However on Windows, if
"Negotiate" with kerberos fails, the browser will try to fall back to try
NTLM (which, I think, freeIPA does not support anyway). Browser asks for
your password to set up the NTLM hashes. Why it does this before checking
if NTLM is available escapes me. When browser sends the first Negotiate
authorization header with NTLMSSP content (which is a negotiation type
message that does not contain any user information) it receceives 401 and
does not continue. So in reality it is not "Basic Auth".
I believe some of the tools accessing freeIPA API may be using this
kerberos authentication. Most likely the "ipa" command also uses this. If
you are authenticated as a freeIPA user and have kerberos properly set up
you can get SSO via this. You can also set up your users in a "trusted" AD
domain to authenticate in the web interface using Negotiate with kerberos
tickets without a password. So it is sometimes beneficial (even on Windows).
The first "fix" disables "Negotiate" authentication for windows
clients.
Which means kerberos login for trusted AD users (if set up) will not work.
The second one disables "Negotiate" authentication for all web UI users
(even those that are not using windows).
Kontakt Jeff Hochberg via FreeIPA-users (<
freeipa-users(a)lists.fedorahosted.org>) kirjutas kuupäeval N, 18. mai 2023
kell 20:34:
Amazing!
I decided to try both your suggested fix as well as the fix suggested in
one of the linked posts - both worked.
Your fix:
1. Create /etc/httpd/conf.d/no-login-popup.conf
2. Add the following text:
BrowserMatch Windows gssapi-no-negotiate
3, Save and restart httpd
I also tested the proposed fix in this post:
https://jdshewey.blogspot.com/2017/08/fixing-annoying-popup-in-freeipa.html
1. Edited /etc/httpd/conf.d/ipa-rewrite.conf
2. Added the following to the bottom of the file:
#The following disables the annoying kerberos popup for Chrome
RewriteCond %{HTTP_COOKIE} !ipa_session
RewriteCond %{HTTP_REFERER} ^(.+)/ipa/ui/$
RewriteRule ^/ipa/session/json$ - [R=401,L]
RedirectMatch 401 ^/ipa/session/login_kerberos
3, Restarted httpd
I agree with you - I'd have to think others run into this as well. At the
very least, there should be an option to enable/disable this in the FreeIPA
dashboard.
Thanks for the assistance!!!
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
9:54 a.m.
New subject: Eliminating Basic Auth Prompt When Accessing FreeIPA Direct
Thanks for the explanation. I figured that's what it was for but it was not
clear as to how to disable it.
It does make sense that Kerberos/NTLM is processed before forms based
authentication. If someone is logging in with Kerberos/NTLM credentials,
they should get authenticated transparently and never see the form.
Being brand new to FreeIPA, I was not familiar with the where/how to modify
the modules and/or priorities.
Glad this forum exists! Thanks for the great support! Really appreciate it!
Jeff Hochberg
Solutions Architect - Network Services
Cloudflare
On Fri, May 19, 2023, 5:17 AM Ahti Seier <ahti.seier(a)gmail.com> wrote:
For some extra context. This has to do with "Negotiate"
authentication.
It is there to allow single sign on via Kerberos. However on Windows, if
"Negotiate" with kerberos fails, the browser will try to fall back to try
NTLM (which, I think, freeIPA does not support anyway). Browser asks for
your password to set up the NTLM hashes. Why it does this before checking
if NTLM is available escapes me. When browser sends the first Negotiate
authorization header with NTLMSSP content (which is a negotiation type
message that does not contain any user information) it receceives 401 and
does not continue. So in reality it is not "Basic Auth".
I believe some of the tools accessing freeIPA API may be using this
kerberos authentication. Most likely the "ipa" command also uses this. If
you are authenticated as a freeIPA user and have kerberos properly set up
you can get SSO via this. You can also set up your users in a "trusted" AD
domain to authenticate in the web interface using Negotiate with kerberos
tickets without a password. So it is sometimes beneficial (even on Windows).
The first "fix" disables "Negotiate" authentication for windows
clients.
Which means kerberos login for trusted AD users (if set up) will not work.
The second one disables "Negotiate" authentication for all web UI users
(even those that are not using windows).
Kontakt Jeff Hochberg via FreeIPA-users (<
freeipa-users(a)lists.fedorahosted.org>) kirjutas kuupäeval N, 18. mai 2023
kell 20:34:
> Amazing!
>
> I decided to try both your suggested fix as well as the fix suggested in
> one of the linked posts - both worked.
>
> Your fix:
> 1. Create /etc/httpd/conf.d/no-login-popup.conf
> 2. Add the following text:
>
> BrowserMatch Windows gssapi-no-negotiate
>
> 3, Save and restart httpd
>
> I also tested the proposed fix in this post:
>
> https://jdshewey.blogspot.com/2017/08/fixing-annoying-popup-in-freeipa.html
>
> 1. Edited /etc/httpd/conf.d/ipa-rewrite.conf
> 2. Added the following to the bottom of the file:
>
> #The following disables the annoying kerberos popup for Chrome
> RewriteCond %{HTTP_COOKIE} !ipa_session
> RewriteCond %{HTTP_REFERER} ^(.+)/ipa/ui/$
> RewriteRule ^/ipa/session/json$ - [R=401,L]
> RedirectMatch 401 ^/ipa/session/login_kerberos
>
> 3, Restarted httpd
>
> I agree with you - I'd have to think others run into this as well. At the
> very least, there should be an option to enable/disable this in the FreeIPA
> dashboard.
>
> Thanks for the assistance!!!
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
353
days inactive
356
days old
freeipa-users@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Ahti Seier -
Jeff Hochberg -
Sam Morris