Kerberos delegation doesn't work in chrome

Question

I have an IIS 7 server with 2 sites - site1, site2.

site1 binds port 80, site2 binds port 81.

I have a web page in site2 which sends an http get request via $.ajax() to a URL in site1.

I've configured both site to use kerberos:

Enabled only windows authentication, selected only negotiate:kerberos in providers.
Configured SPN for the user/server in AD.

I use fiddler to monitor the request headers.

When I use IE8, I see that kerberos ticket is delegated from site2 to site1 via 2-hop, the way kerberos should work.
When I use chrome, I see that keberos ticket is not delegated. I get an 401 error.

I tried setting:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"AuthNegotiateDelegateWhitelist"="*"

...(and specifically the server name), but it has not worked.

Any ideas?

Setting [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "AuthNegotiateDelegateWhitelist"="*" helped me. — Boogier, Dec 09 '15 at 11:06
I was having difficulties getting [AuthServerWhitelist](https://dev.chromium.org/administrators/policy-list-3#AuthServerWhitelist) to work and it seems like Chrome now uses `HKLM\SOFTWARE\Policies\Google\Chrome` for everything instead of `HKLM\SOFTWARE\Policies\Chromium`. With `...\Google\Chrome\AuthServerWhitelist` set as `*.example.com` negotiate/Kerberos works as one would expect. — Samuel Harmer, Apr 14 '16 at 15:13

score 2 · Answer 1 · answered Oct 17 '13 at 18:34

2

I had to add the same registry value to this key to make everything work:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chromium

Also interesting to note that I'm using *.domain.local instead of just *.

answered Oct 17 '13 at 18:34

stames

1,250
1
10
16

score 1 · Answer 2 · answered May 21 '22 at 23:14

1

Just ran into this in 2022. Chrome changed the registry keys, what was Whitelist is no Allowlist. WhiteList no longer used

https://support.google.com/chrome/a/answer/7679408#noNonIncl

answered May 21 '22 at 23:14

Andre

108
10

score 0 · Answer 3 · answered Aug 14 '13 at 15:31

0

Does the value you entered have the quotes in it?

Try entering * with no quotes.

Shut down Chrome entirely (check task manager to make sure) and then try again.

If you use "*" with the quotes it will not work.

answered Aug 14 '13 at 15:31

kralco626

8,456
38
112
169

Ewan · Answer 4 · 2020-06-19T15:16:16.297

Given we now have Edge Chromium. Running the registry script below will fix for both browsers

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge] "AuthNegotiateDelegateAllowlist"="*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "AuthNegotiateDelegateWhitelist"="*"

I extracted both keys from my registry where they have no quotes around * in the registry, however the extracted keys look exactly as I have Posted above

score 0 · Answer 5 · answered Sep 10 '20 at 05:30

It worked only after I added AuthServerWhitelist key in qouple with AuthNegotiateDelegateWhitelist key.

My registry script now looks like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] 
"AuthServerWhitelist"="*"
"AuthNegotiateDelegateWhitelist"="*"

Kerberos delegation doesn't work in chrome

5 Answers5

Linked