999306 - Allow generic NTLM v1 if pref set

Status: VERIFIED FIXED

(Core :: Networking, defect)

Description

[Jason Duell]

This is a followup to bug 828183.  We need to add a pref to permit users who are OK with using the insecure NTLM v1 that we turned off for non-Windows platforms to use it if they really want to (otherwise they may be in a situation where they have no Internet access in Firefox).

Current bikeshed winner for pref name: "network.negotiate-auth.allow-insecure-ntlm-v1".  But I'll leave it to Honza to decide.

This needs to land on Mozilla 30 branch so we don't ship w/o any possibility to use NTLM for a release.

Comment 1

[Honza Bambas (:mayhemer)]

Attachment: v1

Comment 2

[Honza Bambas (:mayhemer)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f8f593eff939

Comment 3

[Jason Duell]

Comment on attachment 8410481 [details] [diff] [review]
v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 828183
User impact if declined:  Non-windows NTLM users completely unable to use Firefox.
Risk to taking this patch (and alternatives if risky): close to zero: just read a pref and toggle existing codepath back on.
String or IDL/UUID changes made by this patch: none

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f8f593eff939

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f2e10998cd71

Comment 7

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Trying to test this, we've asked our IT Networking team if they can set up such an environment for us. Apparently they've done it before, but they say it's fairly complicated and may take some time. Given this, there is a risk that we won't be able to test this in due time for 31. 

If you know any people who already have such an environment set up, it would be good if you could ask them to verify this with the latest Firefox 31 Beta build (ftp://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/). This would save us a lot of time.

Comment 8

[Honza Bambas (:mayhemer)]

Florin, FUY, see https://bugzilla.mozilla.org/show_bug.cgi?id=1030426#c8

Some users were keen to test this for us.  Also let you know the code has already changed, new preferences added/other fix: bug 1023748 and bug 1030426.

Comment 9

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

(In reply to Honza Bambas (:mayhemer) from comment #8)
> Florin, FUY, see https://bugzilla.mozilla.org/show_bug.cgi?id=1030426#c8
> 
> Some users were keen to test this for us.  Also let you know the code has
> already changed, new preferences added/other fix: bug 1023748 and bug
> 1030426.

I see this was tested only in Nightly so far. 

Honza, can you confirm if you guys can handle verification for this in Firefox 31, since we're getting very close to the release? If that's the case I'll remove the "verifyme" keyword and notify our IT department that they no longer need to set this up.

Comment 10

[Honza Bambas (:mayhemer)]

(In reply to Florin Mezei, QA (:FlorinMezei) from comment #9)
> (In reply to Honza Bambas (:mayhemer) from comment #8)
> > Florin, FUY, see https://bugzilla.mozilla.org/show_bug.cgi?id=1030426#c8
> > 
> > Some users were keen to test this for us.  Also let you know the code has
> > already changed, new preferences added/other fix: bug 1023748 and bug
> > 1030426.
> 
> I see this was tested only in Nightly so far. 
> 
> Honza, can you confirm if you guys can handle verification for this in
> Firefox 31, since we're getting very close to the release? If that's the
> case I'll remove the "verifyme" keyword and notify our IT department that
> they no longer need to set this up.

Please talk to those two guys yourself.  I have already spent enormous times on this.  thanks.

Comment 11

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Hi Patrick and Boris, we are trying to verify if NTLM v1 works with Firefox 31 Beta. However, setting the environment for us is a complex job (as reported by our IT Networking team). My understanding is that you could more easily confirm this for us. If so could you install the latest Beta build (ftp://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/31.0b8-candidates/build1/) and let us know here?

Comment 12

[Patrick Weiden]

Hey Florian, I installed the latest beta version of Firefox 31b8 (version en-US of timestamp "08/07/14 01:00:00 am") and can confirm that our SharePoint website authentication (using NTLMv1) works like a charm with the default settings for the two NTLMv1 prefs. Does this information help you?

Comment 13

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

(In reply to Patrick Weiden from comment #12)
> Hey Florian, I installed the latest beta version of Firefox 31b8 (version
> en-US of timestamp "08/07/14 01:00:00 am") and can confirm that our
> SharePoint website authentication (using NTLMv1) works like a charm with the
> default settings for the two NTLMv1 prefs. Does this information help you?

That's great Patrick! I think that should be enough to call this verified (Honza, correct me if I'm wrong). Thank you for the extremely quick answer Patrick.

Comment 14

[Honza Bambas (:mayhemer)]

Thanks!  I think this is now verified fixed :)

Comment 15

[Boris Glawe]

I can also confirm, that it works!