Kerberos SSO, Safari, and IIS web servers

[fatherzimfire]

Hi,

Has anyone found a way of getting kerberos authentication to work correctly (Single Sign On) using Safari with web sites hosted with IIS (on a Windows domain)?
I have all my macs joined to my Active Directory domain, and authenticating using the AD/OD triangle, but no dice.
Thanks in advance.

FZ

[OmniBlade]

Can you get a kerberos ticket using the kerberos app (10.5) or ticket viewer (10.6) and then access the kerberized services without entering further credentials?

[mattai]

Which version of OS X are you running?

[fatherzimfire]

10.5, or 10.6. Kerberos ticket obtained and works fine for SSO with shares etc.
I have since learned that IIS does not support Kerberos SSO with Safari, though Apache should work fine if configured properly.

FZ

[fatherzimfire]

It works if you re-enter your username and password, sure.
I mean true SSO – a webpage authenticating you without you ever having to enter your credentials and saving them in your keychain. Knowing who you are from your kerberos credentials.
As far as I’m aware, this is not possible with IIS.

FZ

[sgstuart]

Hi all,
I did not see this until now. However, IIS can be congiured without a problem to accept kerberos and NTLM. Follow this article.

http://support.microsoft.com/kb/215383

Thanks,
Steven Stuart

[Author]

Posts