NTLM SSO is not working in Firefox

[Jaron Soininen, geändert vor 12 Jahren.]

Hello,

I have successfully setup NTLM SSO with LDAP. However, it only works in Internet Explorer. If I attempt to use Lifreray in Firefox I am redirected to the login page still where as Internet Explorer is logging me in automatically. Is there something specific that I need to do for this to also working in other browsers other than IE? I have already tried adding my Liferay url to the 'network.automatic-ntlm-auth.trusted-uris' in Firefox by following this article http://sivel.net/2007/05/firefox-ntlm-sso/.

Regards,

Jaron

[Kristof Marchal, geändert vor 11 Jahren.]

I have the same problem and tried the same things... so help would be wonderful :-)

[Hitoshi Ozawa, geändert vor 11 Jahren.]

The solution offered in that article only works with Firefox on Windows machine.
The following page may provide assistance:

http://superuser.com/questions/128243/how-do-i-configure-ntlm-authentication-in-firefox-on-linux

[BOINET Eric, geändert vor 11 Jahren.]

Same problem. NTLM works with IE but not with Chrome or Firefox...

[Mika Koivisto, geändert vor 11 Jahren.]

Only IE supports NTLM natively all the other browsers require an extension.

[BOINET Eric, geändert vor 11 Jahren.]

I don't agree with you. FF and chrome doesn't need any extension to work in NTLM with alfresco for example

[Rafael Lluis, geändert vor 11 Jahren.]

FF doesn't need an extension if you follow the instructions here mentioned by Jaron (http://sivel.net/2007/05/firefox-ntlm-sso/) but remember that you have to make these adjutsments on every client on your network (mannually or with a script running at startup)

[BOINET Eric, geändert vor 11 Jahren.]

As Jaron Soininen mentionned in the first post, even if I configure FF according this article, NTLM is not working.

For Chrome, the configuration is more easy : it performs NTLM authentication on websites declared as "Trust Sites" or "intranet sites" in IE configuration. But it does not seem to work either on my Liferay installation (LFP 6.1.1 GA2 CE, tomcat 7).

This blog entry (http://itsliferay.blogspot.fr/2012/11/enable-ntlm-for-other-browser-in.html) says that NTLM in 6.1 is only supported in IE due to security issues. Anyone can confirm ?

[Jitendra Rajput, geändert vor 11 Jahren.]

This blog entry (http://itsliferay.blogspot.fr/2012/11/enable-ntlm-for-other-browser-in.html) says that NTLM in 6.1 is only supported in IE due to security issues. Anyone can confirm ?

Yep .. I wrote that blog and i have verified too that NTLM is working IE only . If you check the code for NTLMFilter then things will be clear to you. I am not exactly sure which plugins/extension are required to make it work in other browser. But i know where to customize from liferay end. I have mentioned the same in blog post.

[BOINET Eric, geändert vor 11 Jahren.]

Thanks Jitendra !

I will forward the information to our developpers.

[Allison Chase, geändert vor 10 Jahren.]

I'm sorry to resurrect this old thread but I really need to get this working.
I read the blog post by Jitendra but I'm not a developer so I wasn't able to figure out how to do it.
This issue was raised in JIRA but it has been "Resolved" with a resolution of "Won't Fix". http://issues.liferay.com/browse/LPS-22375
Mika Koivisto, a previous commenter on this thread, closed it with this incorrect comment:

Neither FF or Chrome has native support for NTLM. NTLM is only built-in to IE.

As stated by Rafael Lluis:

FF doesn't need an extension if you follow the instructions here mentioned by Jaron (http://sivel.net/2007/05/firefox-ntlm-sso/) but remember that you have to make these adjutsments on every client on your network (mannually or with a script running at startup)

We happen to use a login script to change Firefox preferences that allows NTLM authentication. I personally know that it works with Alfresco, Drupal, and Spiceworks.
Can someone please re-open the issue in JIRA and at least request an easier way of allowing NTLM authentication in Firefox and Chrome? It doesn't have to be turned on by default but at least allow us to add a line to portal-ext.properties to enable it.

[suresh vadlamudi, geändert vor 9 Jahren.]

Hi Jaron,

Could you please provide me the steps you followed for NTLM . I have been trying for this but no success. I am facing this issue

Now when I click on sign in button I am getting windows security popup. .Even if I provide the username /password .. it is keep on prompting the same for three times after that showing the blank page.

And here is the exception I am getting

09:11:01,813 INFO [stdout] (http--0.0.0.0-9090-7) 09:11:01,811 ERROR [http--0.0.0.0-9090-7][NtlmFilter:235] Unable to perform NTLM authentication
09:11:01,814 INFO [stdout] (http--0.0.0.0-9090-7) com.liferay.portal.security.ntlm.NtlmLogonException: Session key negotiation failed
09:11:01,815 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.security.ntlm.NetlogonConnection.connect(NetlogonConnection.java:128)
09:11:01,816 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.security.ntlm.Netlogon.logon(Netlogon.java:49)
09:11:01,817 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.security.ntlm.NtlmManager.authenticate(NtlmManager.java:69)
09:11:01,818 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.servlet.filters.sso.ntlm.NtlmFilter.processFilter(NtlmFilter.java:230)
09:11:01,818 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:59)
09:11:01,819 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
09:11:01,820 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
09:11:01,821 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:169)
09:11:01,821 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:88)
09:11:01,822 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:59)
09:11:01,822 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
09:11:01,824 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
09:11:01,825 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:185)
09:11:01,825 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
09:11:01,826 INFO [stdout] (http--0.0.0.0-9090-7) at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:738)
09:11:01,826 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:204)
09:11:01,826 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:109)
09:11:01,827 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:165)
09:11:01,827 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
09:11:01,827 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:165)
09:11:01,828 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
09:11:01,828 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:185)
09:11:01,829 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
09:11:01,829 INFO [stdout] (http--0.0.0.0-9090-7) at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:96)
09:11:01,829 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
09:11:01,830 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
09:11:01,830 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275)
09:11:01,831 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
09:11:01,831 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:397)
09:11:01,831 INFO [stdout] (http--0.0.0.0-9090-7) at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
09:11:01,832 INFO [stdout] (http--0.0.0.0-9090-7) at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153)
09:11:01,832 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155)
09:11:01,833 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
09:11:01,833 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
09:11:01,833 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368)
09:11:01,834 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877)
09:11:01,834 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671)
09:11:01,834 INFO [stdout] (http--0.0.0.0-9090-7) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930)
09:11:01,835 INFO [stdout] (http--0.0.0.0-9090-7) at java.lang.Thread.run(Thread.java:745)

Thanks & Regards
Suresh

[BOINET Eric, geändert vor 8 Jahren.]

Je suis absent(e) du bureau jusqu'au 01/02/2015

Eric BOINET ne fait plus partie de la société IMA Technologies.

Merci de contacté maintenant M. SOULARD Martin
Coordonées :
Mail : [e-mail]
Tel : [phone]



Note: This is an automated response to your message "[Liferay Forums][1.
Installation / Deployment / Setup] RE: NTLM SSO is not working in Firefox"
sent on 19/08/2014 16:22:01.

This is the only notification you will receive while this person is away.

[BOINET Eric, geändert vor 8 Jahren.]

Je suis absent(e) du bureau jusqu'au 01/02/2015

Eric BOINET ne fait plus partie de la société IMA Technologies.

Merci de contacté maintenant M. SOULARD Martin
Coordonées :
Mail : [e-mail]
Tel : [phone]



Note: This is an automated response to your message "[Liferay Forums][1.
Installation / Deployment / Setup] RE: NTLM SSO is not working in Firefox"
sent on 19/08/2014 16:22:01.

This is the only notification you will receive while this person is away.

[BOINET Eric, geändert vor 8 Jahren.]

Je suis absent(e) du bureau jusqu'au 01/02/2015

Eric BOINET ne fait plus partie de la société IMA Technologies.

Merci de contacté maintenant M. SOULARD Martin
Coordonées :
Mail : [e-mail]
Tel : [phone]



Note: This is an automated response to your message "[Liferay Forums][1.
Installation / Deployment / Setup] RE: NTLM SSO is not working in Firefox"
sent on 19/08/2014 16:22:01.

This is the only notification you will receive while this person is away.

[BOINET Eric, geändert vor 8 Jahren.]

Je suis absent(e) du bureau jusqu'au 01/02/2015

Eric BOINET ne fait plus partie de la société IMA Technologies.

Merci de contacté maintenant M. SOULARD Martin
Coordonées :
Mail : [e-mail]
Tel : [phone]



Note: This is an automated response to your message "[Liferay Forums][1.
Installation / Deployment / Setup] RE: NTLM SSO is not working in Firefox"
sent on 19/08/2014 16:22:01.

This is the only notification you will receive while this person is away.

[BOINET Eric, geändert vor 8 Jahren.]

Je suis absent(e) du bureau jusqu'au 01/02/2015

Eric BOINET ne fait plus partie de la société IMA Technologies.

Merci de contacté maintenant M. SOULARD Martin
Coordonées :
Mail : [e-mail]
Tel : [phone]



Note: This is an automated response to your message "[Liferay Forums][1.
Installation / Deployment / Setup] RE: NTLM SSO is not working in Firefox"
sent on 19/08/2014 16:22:01.

This is the only notification you will receive while this person is away.