Macintosh Safari Browser and IIS with Kerberos

[Tim Alsop]

We now have authentication to IIS working with Max OSX 10.3. However, we cannot find a way to get Safari to forward credentials to IIS. The initial tgt is forwardable, but it is not being forwarded ... I can see that normally a Safari user would only want to allow their web server application determine their identity and this is clearly working, but our needs are beyond that since we want the IIS application to use the users credentials to setup a security context with a third-tier ...

Tim. 

-----Original Message-----
From: Tim Alsop [mailto:Tim.Alsop at cybersafe.ltd.uk] 
Sent: 05 December 2003 08:53
To: swbell; kerberos at mit.edu
Subject: RE: Macintosh Safari Browser and IIS with Kerberos

Thankyou.
Can you let me know when/if you hear of a solution being available. I will do likewise.
Tim. 

-----Original Message-----
From: swbell [mailto:kerygma2 at swbell.net]
Sent: 04 December 2003 22:26
To: kerberos at MIT.EDU
Subject: Re: Macintosh Safari Browser and IIS with Kerberos

I've been told this should work on Panther (not sure about Jaguar).  I did a network trace, and sure enough, my Mac asked for a service ticket.
Unfortunately, the service principal name was "www" (yep - that's the whole thing).  I'm waiting to hear back from Apple on how they came up with this principal name, but I'm guessing that they don't understand Kerberos.
Perhaps they will fix this - hopefully soon.  I believe they tested the Kerberos stuff with an Apache web server and not with IIS.


in article
815D636CDFAAD611A2DA006097AC6157DE4734 at blackanwhitecat.cybersafe.ltd.uk, Tim Alsop at Tim.Alsop at cybersafe.ltd.uk wrote on 12/4/03 11:34 AM:

> Hi,
> 
> I am new to Macintosh platform, but I understand that a Macintosh 
> running Mac OSX can authenticate a user by getting a tgt from Active 
> Directory and then the Safari browser can use this ticket to 
> authenticate the user to an IIS web server in the same way that a 
> Windows workstation can do this with IE and Windows Integrated Authentication.
> 
> Is the above statement correct ?
> If so, how do we setup the Mac Kerberos software and/or Safari browser 
> to make this work ?
> 
> Thanks, Tim.
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 


________________________________________________
Kerberos mailing list           Kerberos at mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list           Kerberos at mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos