firefoxkerberos

Firefox doesn't show the kerberos challenge

I'm building an app behind IIS. IIS manages authentication and reverse proxy to my app.

in IIS :

I think my IIS configuration is fine (app pool account liked to spn etc.) because I can access my app through Chrome and solve the kerberos challenge without any problem. Chrome shows me the login popup, I fill my credentials then I can login and see my app.

Firefox actual behaviour :

enter image description here

Things I've tried in about:config in Firefox

But no result

Below is the http header returned by IIS to Firefox :

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
WWW-Authenticate: Negotiate
Date: Mon, 30 Jun 2025 21:19:29 GMT
Content-Length: 5931
Solution

  • That's the intended behavior. Firefox does not support prompting for explicit credentials (and indeed the majority of Kerberos client applications don't); it only uses "ambient" credentials, i.e. what SSPI or GSSAPI can obtain without prompting.

    Chrome and Internet Explorer (which achieve this using Windows-specific SSPI APIs) are more of an exception, not the rule.

    If you are on Windows and are using a local (non-domain) Windows account, store your domain credentials in the Windows Credential Vault, e.g. using cmdkey /add:*.example.com. SSPI will automatically obtain Kerberos tickets when Firefox requests them.

    If you are on Linux, the GSSAPI (Unix equivalent of Microsoft SSPI) doesn't even have the ability to use explicit credentials; Firefox could still have implemented it by using raw Krb5 APIs but generally speaking that's just not something GSSAPI-using Kerberos client software tend to do at all.