double basic authentication

[nestle2377]

I've implemented the gssapi using the GssapiBasicAuth directive.

it works fine on every browser except internet explorer and Edge.

in these browser I've before the GSSAPI basic login the basic browser login.

so I've to insert 2 times the credential (if i click cancel on the first basic login i'm not authorized).
maybe the http 401 cause the basic auth on the browser.

anyone has this problem? any idea to solve?

thanks

[simo5]

I remember seeing this in the past, but I do not recall if a solution was found, maybe someone else will comment.

[simo5]

Found it: https://bugzilla.redhat.com/show_bug.cgi?id=1309041
If you follow that bug you should be able to tweak your config to make Microsoft browsers happier, I hope.

[nestle2377]

thanks a lot! later I will try the BrowserMatch MSIE gssapi-no-negotiate directive and I let you know.

thanks for support

[nestle2377]

I've try the browsermatch directive but using this directive the automatic domain logon doesn't work. it always ask for basic (one time) but for user in domain also ask for basic so I loose the domain SSO.

[nestle2377]

I've made more test and with GssapiBasicAuth On, when a pc is not under domain, only firefox browser shows correctly one basic popup.
Both chrome and IE (and edge) first show a generic basic popup, that doesn't autenticate agains gssapi, ad after the basic that works with the gssapi. so we have a double basic popup request with all browser except for firefox.

[simo5]

I think what you may be seeing with Edge/IE is an initial attempt at NTLMSSP auth, followed by Basic Auth.
If you need SSO I do not know a way to fix this with IE/Edge, they seem to always attempt NTLMSSP, which will cause the browser to raise a popup.