5

What's the differences between these two chrome policy registers AuthServerWhitelist and AuthNegotiateDelegateWhitelist?

I started doubting when I've found out those two registers while I was trying to automate a login for an intra-net.

First I tried out with AuthServerWhitelist and it didn't work.

Then I set up both AuthServerWhitelist and AuthNegotiateDelegateWhitelist and it worked.

I cannot see right now what's the difference, although I read they have two different functions.

Chromium Policies list link

Thanks a lot in advance!!

2 Answers 2

2

The difference between the two is related to Kerberos, impersonation levels and the difference between impersonation and delegation.

In simple terms (I'm not an expert):

AuthServerWhitelist specifies which servers are allowed for integrated authentication. By default, however, this only supports impersonation not delegation. So, if you add a server to AuthServerWhitelist, you can, for example, log in to a website which can then impersonate your user. However, let's say that website would further want to connect and authenticate to an SQL Server database on behalf of your user. That would not work since this is delegation.

Adding the server additionally to AuthNegotiateDelegateWhitelist should enable that delegation use-case, provided you are using Kerberos (Negotiate) and everything has been set up correctly.

2

Maybe important for all of you searching, the Key AuthNegotiateDelegateWhitelist got renamed to AuthNegotiateDelegateAllowlist in case you are running into trouble now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.