3

We have a Web site (out intranet site) that uses pass though authentication and signs people in automatically. This application works seamlessly when using a Windows machine. All of our Windows machines are Windows 7 64 bit. We have several Mac OS machines on site and would like to have the Macs also sign people in automatically. They are using AD to sign people in so I am thinking there is a way to make this work.

The Macs are version 10.7 and 10.8. Neither work. It comes up with a log in box and if you enter in the Network name and password it does work and lets you in. I am wondering if there is a way to make that happen automatically. The web site was built using Word Press. Any help is greatly appreciated. Sorry if I have left out important information.

2 Answers 2

4

They are using AD to sign people in so I am thinking there is a way to make this work.

Do you mean by this that users log into OS X using their AD username and password? If so, they may already have Kerberos credentials once they’re logged in. To check this, use the klist command from a terminal prompt; you should see something like:

$ klist
Credentials cache: API:17DFC650-1327-4721-92ED-A0099CA09885
        Principal: [email protected]

  Issued                Expires               Principal
Mar 10 01:17:16 2014  Mar 10 09:17:16 2014  krbtgt/[email protected]

If not, use kinit user@REALM from a command prompt to authenticate. The REALM will be the AD domain name. When it was based on MIT Kerberos, Apple’s Kerberos implementation would automatically bring up a GUI panel when a program needed Kerberos and the user was not authenticated; unfortunately when they switched to Heimdal they dropped this nice feature, and now you have to do it manually.

You may need other configuration as well to get this working depending on the environment, but this is required in any case, and this and the rest may just work if everything is set up conveniently (e.g. the KDCs are discoverable via the DNS, the web server principal name is determined properly from its DNS name with the default rules, etc.). If not, I can help you figure out what else needs to be done.

2

It is possible. I'm able to login to intranet sites secured with Negotiate WIS using Safari on a Mac without a login prompt.

I had to join my computer to the domain by adding a "Network Account Server" in System Preferences > Users & Groups > Login Options.

When I login using my Active Directory account I'm able to open secured sites in Safari w/o a prompt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .