1471651 - Extend Authentication with a couple additional prefs

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect, P1)

Description

[Mike Kaply [:mkaply]]

https://github.com/mozilla/policy-templates/issues/118

pref("network.automatic-ntlm-auth.allow-non-fqdn", true);
pref("network.negotiate-auth.allow-non-fqdn", true);

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1471651 - Allow Non FQDN to be specified in policy.

Review commit: https://reviewboard.mozilla.org/r/253478/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/253478/

Comment 2

[Mike Kaply [:mkaply]]

Github change is here:

https://github.com/mozilla/policy-templates/pull/180

Comment 3

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

https://reviewboard.mozilla.org/r/253478/#review260098

::: browser/components/enterprisepolicies/Policies.jsm:76
(Diff revision 1)
> +        if (param.AllowNonFQDN.NTLM) {
> +          setAndLockPref("network.automatic-ntlm-auth.allow-non-fqdn", param.AllowNonFQDN.NTLM);
> +        }

is this only useful as `true`? if `false` is also useful, this needs to change to `if ("NTML" in param.AllowNonFQDN)`

::: browser/components/enterprisepolicies/Policies.jsm:79
(Diff revision 1)
>        }
> +      if ("AllowNonFQDN" in param) {
> +        if (param.AllowNonFQDN.NTLM) {
> +          setAndLockPref("network.automatic-ntlm-auth.allow-non-fqdn", param.AllowNonFQDN.NTLM);
> +        }
> +        if (param.SPNEGO) {

did you mean `param.AllowNonFQDN.SPNEGO`?

And the same question as above applies

Comment 4

[Mike Kaply [:mkaply]]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

https://reviewboard.mozilla.org/r/253478/#review260098

> is this only useful as `true`? if `false` is also useful, this needs to change to `if ("NTML" in param.AllowNonFQDN)`

Only useful if true. They default to false.

Comment 5

[Mike Kaply [:mkaply]]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/253478/diff/1-2/

Comment 6

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

https://reviewboard.mozilla.org/r/253478/#review260140

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a9c85d545b47
Allow Non FQDN to be specified in policy. r=Felipe

Comment 8

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/a9c85d545b47

Comment 9

[Mike Kaply [:mkaply]]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

Approval Request Comment
[Feature/Bug causing the regression]: New Policy
[User impact if declined]: Policy not available.
[Is this code covered by automated tests?]: Yes.
[Has the fix been verified in Nightly?]: No.
[Needs manual test from QE? If yes, steps to reproduce]: Yes (with other policy changes).
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Adds new policy, doesn't affect existing policy.
[String changes made/needed]:

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:
User impact if declined: Adds new policy
Fix Landed on Version: 62
Risk to taking this patch (and alternatives if risky): Very low risk. Policy change only with test.
String or UUID changes made by this patch: 

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.'

Note it's possible this patch won't apply clean due to the removal of first_available here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1463902

I'll create new patches if necessary. Alternatively we could take that patch (it's cosmetic), but I didn't want to add extra work.

Comment 10

[Liz Henry (:lizzard)]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

Policy-only change, includes new tests. Let's uplift for beta 15.

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/6a8ce370f814

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8988245 [details]
Bug 1471651 - Allow Non FQDN to be specified in policy.

Policy engine fix needed on ESR60. Approved for ESR 60.2.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/35c5bf5a7aec

Comment 14

[Abe - QA (:Abe_LV)]

This bug will be tested and verified by Emil as part of "New Enterprise Policy" PI request.

Comment 15

[Emil Ghitta, QA [:emilghitta]]

This bug was covered by the overall testing efforts invested in the New Enterprise Policies feature.

Marking this as verified fixed using Firefox 63.0a1 (BuildId:20180822221004), Firefox 62.0b19 (BuildId:20180820172315) and the ESR try build (provided in comment 13) on Windows 10 64bit.