Re: [Freeipa-users] Authentication Pop-up appearing for IPA WebUI

[Tomasz Torcz]

On Fri, Dec 30, 2016 at 10:19:30PM +0530, Abhinay Reddy Peddireddy wrote:
> Hi,
> 
> Yes. It is fine with Firefox. But not with chrome.
> 
> However customer is expecting the same on Chrome also.
> 
> Ant modifications can be done to avoid the pop-up ?


  See https://fedorahosted.org/freeipa/ticket/5614  and
https://github.com/modauthgssapi/mod_auth_gssapi/pull/65 , 
setting ”GssapiNegotiateOnce” looks relevant.

-- 
Tomasz Torcz Morality must always be based on practicality.
xmpp: zdzich...@chrome.pl-- Baron Vladimir Harkonnen

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Authentication Pop-up appearing for IPA WebUI

[Marc Boorshtein]

Not in chrome. If you don't want kerberos at all for the console you could
try disabling it in Apache but that will break with every update to ipa

On Fri, Dec 30, 2016, 11:49 AM Abhinay Reddy Peddireddy 
wrote:

> Hi,
>
> Yes. It is fine with Firefox. But not with chrome.
>
> However customer is expecting the same on Chrome also.
>
> Ant modifications can be done to avoid the pop-up ?
>
> On Fri, Dec 30, 2016 at 10:05 PM, Marc Boorshtein <
> marc.boorsht...@tremolosecurity.com> wrote:
>
> it looks like you are using chrome?  we have a customer with a similar
> issue.  Chrome doesn't follow the specs around kerberos, if it receives a
> 401 it will generally prompt you even if you are not a member of a domain.
> My guess is if you try it with Firefox or IE you should be fine and not get
> the prompt.
>
> On Fri, Dec 30, 2016 at 10:52 AM Abhinay Reddy Peddireddy <
> apedd...@redhat.com> wrote:
>
> Hello Team,
>
> I have a customer testing IPA on RHEL 7.
>
> When he tries to access the WebUI, it prompts for the username and
> password as a pop-up as shown in the below attached image.
>
> This happens with Google Chrome and Internet Explorer only. But it appears
> normal in Firefox.
>
> Customer is expecting a normal authentication prompt. Is this something to
> be checked from IPA end. I hope this has to be corrected or modified from
> browser end.
>
> Any suggestions ?
>
> Thanks and Regards,
> Abhinay Reddy.
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project
>
> --
> Marc Boorshtein
> CTO Tremolo Security
> marc.boorsht...@tremolosecurity.com
> (703) 828-4902
> Twitter - @mlbiam / @tremolosecurity
>
>
> --
Marc Boorshtein
CTO Tremolo Security
marc.boorsht...@tremolosecurity.com
(703) 828-4902
Twitter - @mlbiam / @tremolosecurity
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Authentication Pop-up appearing for IPA WebUI

[Abhinay Reddy Peddireddy]

Hi,

Yes. It is fine with Firefox. But not with chrome.

However customer is expecting the same on Chrome also.

Ant modifications can be done to avoid the pop-up ?

On Fri, Dec 30, 2016 at 10:05 PM, Marc Boorshtein <
marc.boorsht...@tremolosecurity.com> wrote:

> it looks like you are using chrome?  we have a customer with a similar
> issue.  Chrome doesn't follow the specs around kerberos, if it receives a
> 401 it will generally prompt you even if you are not a member of a domain.
> My guess is if you try it with Firefox or IE you should be fine and not get
> the prompt.
>
> On Fri, Dec 30, 2016 at 10:52 AM Abhinay Reddy Peddireddy <
> apedd...@redhat.com> wrote:
>
>> Hello Team,
>>
>> I have a customer testing IPA on RHEL 7.
>>
>> When he tries to access the WebUI, it prompts for the username and
>> password as a pop-up as shown in the below attached image.
>>
>> This happens with Google Chrome and Internet Explorer only. But it
>> appears normal in Firefox.
>>
>> Customer is expecting a normal authentication prompt. Is this something
>> to be checked from IPA end. I hope this has to be corrected or modified
>> from browser end.
>>
>> Any suggestions ?
>>
>> Thanks and Regards,
>> Abhinay Reddy.
>> --
>> Manage your subscription for the Freeipa-users mailing list:
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>> Go to http://freeipa.org for more info on the project
>
> --
> Marc Boorshtein
> CTO Tremolo Security
> marc.boorsht...@tremolosecurity.com
> (703) 828-4902
> Twitter - @mlbiam / @tremolosecurity
>
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Authentication Pop-up appearing for IPA WebUI

[Marc Boorshtein]

it looks like you are using chrome?  we have a customer with a similar
issue.  Chrome doesn't follow the specs around kerberos, if it receives a
401 it will generally prompt you even if you are not a member of a domain.
My guess is if you try it with Firefox or IE you should be fine and not get
the prompt.

On Fri, Dec 30, 2016 at 10:52 AM Abhinay Reddy Peddireddy <
apedd...@redhat.com> wrote:

> Hello Team,
>
> I have a customer testing IPA on RHEL 7.
>
> When he tries to access the WebUI, it prompts for the username and
> password as a pop-up as shown in the below attached image.
>
> This happens with Google Chrome and Internet Explorer only. But it appears
> normal in Firefox.
>
> Customer is expecting a normal authentication prompt. Is this something to
> be checked from IPA end. I hope this has to be corrected or modified from
> browser end.
>
> Any suggestions ?
>
> Thanks and Regards,
> Abhinay Reddy.
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project

-- 
Marc Boorshtein
CTO Tremolo Security
marc.boorsht...@tremolosecurity.com
(703) 828-4902
Twitter - @mlbiam / @tremolosecurity
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project