I would like to be able to take advantage of Kerberos without having to join my machine to the domain.
Why? Because this is a personal machine and we are not allowed to join them the corporate domain (nor we can).
Here is my partial success so far. I was able to setup Kerberos authentication but only on Firefox and Google Chrome, on Safari it doesn't work and it seems to be impossible to make it work without really joining the domain.
>kinit username@EXAMPLE.COM >klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: user@EXAMPLE.COM Valid starting Expires Service principal 06/05/14 11:36:00 06/05/14 21:36:06 krbtgt/EXAMPLE.COM@EXAMPLE.COM renew until 07/05/14 11:36:00
Now you can use
/System/Library/CoreServices/Ticket Viewer.app to view the ticket, or to renew it when it expires.
curl -v --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt --output /dev/null http://example.com
about:config and configure
defaults write com.google.Chrome AuthServerWhitelist "*.example.com" defaults write com.google.Chrome AuthNegotiateDelegateWhitelist "*.example.com"
Base on https://www.pingidentity.com/support/solutions/index.cfm/How-to-configure-supported-browsers-for-Kerberos-NTLM#safari it seems that Safari will use SPNEGO only when it is joined into the domain. Otherwise it will only try NTLM which is probably disabled as being insecure.
Any contributions are more than welcomed!