I encountered a bug in Safari, where an internal website that has NTLM Negotiate enabled keeps reloading.
Confirming with Wireshark, I see a continuous loop of Safari trying to request the page, and the server responding with 401.
Another instance of the application on another domain just works. The difference in the two responses from safari is that for the application it works it responds with a
Kerberos AP-REQ response, but in the application it doesn't work, it responds with
NTLM Secure Service Provider.
I also tested another application, and there the same problem happens.
klist -f I see the main Kerberos ticket, and a specific one for the domain it works, but not one for the domains it doesn't work for. I tried recreating the kerberos ticket, but that doesn't solve it.
Does anyone know how to solve this problem and why the ticket isn't sent to these domains?