423778 - SPNEGO fails even though credentials are available if client is interactively logged into webserver

Status: UNCONFIRMED

(Core :: Networking: HTTP, defect, P5)

Description

[John Wehle]

User-Agent:       Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20051027
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12

The Microsoft Negotiate SSPI apparently has (according to Microsoft
tech support) special case code which results in a raw NTLM token
being supplied instead of a SPNEGO token if the user happens to
also be interactively logged into the webserver (i.e. the webserver
is running on a large machine which also supplies remote terminal
services).  This of course violates RFC4559 and causes SSO authentication
to fail with the webserver (unless the server has special case code).

Reproducible: Always

Steps to Reproduce:
1. Setup a webserver configured for SPNEGO / Kerberos authentication on a Windows
   machine.
2. Load Firefox on the same machine.
3. Log into the machine as a Kerberos user and try using Firefox to access a
   page on the webserver which requires SPNEGO / Kerberos authentication.
Actual Results:  
The authentication fails and the packet trace shows that Firefox responded to the
401 Negotiate by supplying a raw NTLM token.

Expected Results:  
The authenticion to work, or at the very least the packet trace showing that
Firefox responded to the 401 with a SPNEGO (encapsulating either NTLM or 
Kerberos).

If kfw is loaded on the machine and Firefox is configured so that it doesn't
use the Microsoft Negotiate SSPI, then the authentication works.

One possible solution is for Firefox to implement SPNEGO directly and just
call the Microsoft SSPI for Kerberos and NTLM instead of trusting the Microsoft
SSPI to correctly handle the SPNEGO.

Comment 1

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258