WWW-Authenticate not working with Kerberos (only NTLM)

2
votes

I'm having a problem to setup SSO for the intranet websites. Currently i'm working with Tomcat 8.0 and Waffle 1.8.4. They work great, but there is only 1 problem: the browsers (Firefox and IE after the settings were applied as described here and here) can not do Kerberos authentication, only NTLM.

I analyzed the traffic with Wireshark, Tomcat sends the http header field "WWW-Authenticate" and the browser answers a base64-encoded string in the header field "Authentication", that contains NTLMSSP. I guess this is not Kerberos, or is it ?

I read a post (WWW-Authenticate uses NTLM and not Kerberos), that for Kerberos to work, the server has to be registered in the AD with the command setspn.exe. I try to get the right syntax for setspn (described here), but without any luck. The server has the following parameters:

  • IP: 10.0.0.1

  • Service: Tomcat-Http

  • Port: 8080

  • Accountname: company-net\foobar

I use this command for setspn:

setspn -A "HTTP/10.0.0.1:8080 company-net\foobar"

but not works. Both the server and the client are in the same Windows domain, using Windows 10.

What is wrong with it?

Do i need anything else ?

1
single-sign-onkerberosntlm

1 Answers

0
votes

Kerberos relies on DNS (valid hostnames) and SPNs to function. Looks like you've done a bit of research so far which is good. What isn't that well known is that when you point an otherwise perfectly working fine Kerberos client to the IP of a host, rather than to it's DNS hostname, Kerberos will be bypassed and the fallback authentication mechanism will be employed instead - NTLM in this case.

Michael-O, the top Kerberos contributor to this forum, said it best with his answer about this back in 2012:

Kerberos does not work with IP adresses, it relies on domain names and correct DNS entries only.