topic Re: Does anyone know what I have to do to Chrome to make it SSO? in Alfresco Archive

Does anyone know what I have to do to Chrome to make it SSO?

throwback — Tue, 02 Oct 2012 13:49:46 GMT

The wiki has detailed instructions for Firefox, and Internet explorer SSO works out of the box, but I cannot for the life of me figure out what I'm supposed to do to make Chrome sso with Alfresco (LDAP sync/Kerberos SSO auth, tested working with other browsers).Desperate to achieve this because alfr

Re: Does anyone know what I have to do to Chrome to make it SSO?

loftux — Tue, 02 Oct 2012 15:04:26 GMT

I haven't tried getting Kerberos SSO to work with Chrome, nevertheless I will try to help
Another article on the topic http://www.microhowto.info/howto/configure_chromium_to_authenticate_using_spnego_and_kerberos.html

Be sure to use the full dns and the same ones you actually use in the browser. Try authentication to serverort/alfresco first, it is usually easier to get that to work. Then move on to get /share to work. Make sure to specify the delegation command line parameter.
Post the parameters you have tried, and especially the ones that works if you get it to work.

Re: Does anyone know what I have to do to Chrome to make it SSO?

nwheatley — Tue, 01 Oct 2013 23:28:35 GMT

I didn't see this answered anywhere else, and we just got Kerberos SSO working through Chrome in our environment so I'll post an update. Basically you need to create/update some registry values (that do not exist by default) to whitelist auth server(s) and kerberos delegation for Chrome. See herefor full documentation on Chrome policy templates and references of all the reg values.: https://support.google.com/chrome/a/answer/187945?hl=en

At a minimum you'll need to set the following registry values to get SSO working in Chrome:
[HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome]
"AuthNegotiateDelegateWhitelist"="www.yourAlfServer.com"
"AuthSchemes"="basic,digest,ntlm,negotiate"
"AuthServerWhitelist"="www.yourAlfServer.com"

As a test stick those values into a .reg file and import them to your local registry. Restart Chrome and SSO should work (in theory anyway). You may need to tweak on some additional registry values for SPN settings or to whitelist plugins for SPP (Sharepoint) functionality but this should get you started. Full documentation is available at the above link.

Re: Does anyone know what I have to do to Chrome to make it SSO?

jean-rémyrevy — Wed, 28 Jan 2015 13:07:32 GMT

Be careful, in latest chrome enterprise versions (> 34~), this LocalMCX method seems to no longer be available. It use directly GPO bypassing local registry.