240643 - Suppress bogus Kerberos prompt on Mac OSX [was: Autthentication Failover not fully supported between connection based Authentication Types]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Christopher Nebergall]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

With every new connection all of the auth types are tried in order if all of the
types don't support re-using the cached challenge. They ignore what worked
previously.  This is why on a Mac users retrieve repeated Kerberos prompts to
get credentials.  If they click cancel on the prompt they will get another
prompt later, when a new connection is made. 

I can think of two possible solutions.

1.  Turn prompting off for Negotiate on Mac OS X.  (I have a patch to do this,
but it doesn't solve the general problem). But if the problem is server side, it
will still re-try and fail with every new connection.

2.  Find some way of caching the last successful authentication type for a
particular server and try that first.   This is already done for authentication
types where the challenge can be reused, but not types like NTLM or Negotiate
that don't re-use a challenge.

Reproducible: Didn't try
Steps to Reproduce:

Comment 1

[Christopher Nebergall]

Attachment: Mac OS X patch to disable prompting

Comment 2

[Mike Stockman]

Adding myself to the CC list, and hoping that someone can help review this patch
soon. The kerberos prompting occurs repeatedly during an Outlook Web Access
session, and can get a little frustrating if one uses Mozilla or Firebird on Mac
to read mail.

Comment 3

[Christopher Nebergall]

I agree we should at least start discussing this problem I'm not sure if this is
the correct solution though. 

From your comments in the other bug (Bug 238316), it seems in your situation you
don't have kerberos credentials at all. So for the time being you should disable
SPNEGO support since it is really of no value to you and at this point is mainly
an annoyance. (http://bugzilla.mozilla.org/show_bug.cgi?id=238316#c18)

I don't know how common your problem is, most people who have an IIS box which
is new enough to support Integrated Windows authentication, are also using
Active Directory which supports kerberos.

Comment 4

[Mike Stockman]

Thank you, the suggested change to suppress the kerberos authentication worked
well in both Moz and Firefox. Both can now log in securely to Exchange 2000
without seeing the extraneous authentication dialog. Not a fix, but a workaround. 
Thanks.

Comment 5

[Darin Fisher]

Comment on attachment 146225 [details] [diff] [review]
Mac OS X patch to disable prompting

r+sr=darin

I'm happy to get this into the tree if it will stave off problems like this. 
If there is something better that we should be doing instead, we can always
back this out and do that instead.

Comment 6

[Darin Fisher]

Perhaps we should try to get this in for FFox 1.0 and Moz 1.7.1?

Comment 7

[Darin Fisher]

Attachment: version of patch checked in on the trunk

Comment 8

[Darin Fisher]

fixed-on-trunk

Comment 9

[Darin Fisher]

I guess this means that this bug has morphed a bit.  It was about fixing the
more generic problem.  However, I'd rather we open a new bug if there is indeed
more work to be done.  Since we want to get this patch into 1.7.1 and ffox 1.0,
I think it simplifies project management to have separate bugs.

Comment 10

[Darin Fisher]

REOPENING this bug.  the patch broke the tinderbox OSX builds.

Comment 11

[Darin Fisher]

Here's the build error from "Darwin 6.8 monkey":

c++ -o nsNegotiateAuthGSSAPI.o -c -DOSTYPE=\"Darwin6.8\" -DOSARCH=\"Darwin\"
-DHAVE_DEPENDENT_LIBS -DUSE_GSSAPI  -I../../dist/include/xpcom
-I../../dist/include/string -I../../dist/include/necko -I../../dist/include/pref
-I../../dist/include/negotiateauth -I../../dist/include
-I/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/obj/dist/include/nspr  
  -I.    -fPIC   -fno-rtti -fno-exceptions -Wall -Wconversion -Wpointer-arith
-Wcast-align -Woverloaded-virtual -Wsynth -Wno-ctor-dtor-privacy
-Wno-non-virtual-dtor -Wno-long-long -fpascal-strings -no-cpp-precomp
-fno-common -fshort-wchar -I/Developer/Headers/FlatCarbon -pipe  -DNDEBUG
-DTRIMMED -O   -DMOZILLA_CLIENT -include ../../mozilla-config.h
-Wp,-MD,.deps/nsNegotiateAuthGSSAPI.pp
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:
In
   member function `virtual nsresult nsNegotiateAuth::GetNextToken(const void*, 
   unsigned int, void**, PRUint32*)':
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:224:
`
   KLBoolean' undeclared (first use this function)
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:224:
(Each
   undeclared identifier is reported only once for each function it appears 
   in.)
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:224:
parse
   error before `;' token
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:225:
`
   kerberosVersion_V5' undeclared (first use this function)
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:225:
`
   found' undeclared (first use this function)
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:225:
`
   KLCacheHasValidTickets' undeclared (first use this function)
/builds/tinderbox/SeaMonkey/Darwin_6.8_Depend/mozilla/extensions/negotiateauth/nsNegotiateAuthGSSAPI.cpp:225:
`
   klNoErr' undeclared (first use this function)

I guess that we are missing some header file???

Comment 12

[jhp (no longer active)]

Attachment: added missing header

Patch was just missing a header.  Checked in to trunk.

Comment 13

[Darin Fisher]

Thanks Javier!!

Comment 14

[Darin Fisher]

marking FIXED again.

Comment 15

[Darin Fisher]

Comment on attachment 151884 [details] [diff] [review]
added missing header

would be good to get this on the 1.7 branch.  only affects Mac OSX users.

Comment 16

[Mike Kaply [:mkaply]]

Comment on attachment 151884 [details] [diff] [review]
added missing header

a=mkaply

Comment 17

[Darin Fisher]

fixed1.7.1

Comment 18

[Mike Connor [:mconnor]]

Darin, can you land this on the aviary branch as well?

Comment 19

[Darin Fisher]

fixed-aviary1.0

actually, i ported the entire trunk spnego+ntlm code onto the aviary 1.0 branch,
see bug 246861.

Comment 20

[Darin Fisher]

er, i meant see bug 237586.