I encountered a bug in Safari, where an internal website that has NTLM Negotiate enabled keeps reloading.

Confirming with Wireshark, I see a continuous loop of Safari trying to request the page, and the server responding with 401.

Another instance of the application on another domain just works. The difference in the two responses from safari is that for the application it works it responds with a Kerberos AP-REQ response, but in the application it doesn't work, it responds with NTLM Secure Service Provider.

I also tested another application, and there the same problem happens.

Using klist -f I see the main Kerberos ticket, and a specific one for the domain it works, but not one for the domains it doesn't work for. I tried recreating the kerberos ticket, but that doesn't solve it.

Does anyone know how to solve this problem and why the ticket isn't sent to these domains?

  • I managed to get Kerberos working from the command line using CURL but not using any web browser. I am really interested into sorting this. Any news? – sorin May 6 '14 at 12:12

You must log in to answer this question.

Browse other questions tagged .