Using Touchstone with Kerberos Tickets (via SPNEGO)

The instructions below are for advanced users. Typically [Touchstone] users find it easier to use one of the other supported authentication methods (certificate, username/password).

This article has a few pointers for using MIT Touchstone with Kerberos Tickets.

Overview

You can use your existing Kerberos tickets to authenticate to the MIT Touchstone login server (idp.mit.edu) via the Simple and Protected GSS-API Negotiation Mechanism ("SPNEGO") protocol over HTTP.

Prerequisites

• Your browser must support the HTTP Negotiate mechanism
• You must have a valid Kerberos ticket for the ATHENA.MIT.EDU realm
• You must configure the browser to enable negotiation with the Touchstone server (see instructions below)

Getting Kerberos Tickets

If you're on an Athena workstation or WIN.MIT.EDU client, you will normally acquire Kerberos
tickets at login and can skip this step.

You must be an administrator of your workstation and install software from the administrator account.

1. Download and install MIT Kerberos for Windows (KfW) or Kerberos Extras for Mac from the MIT Kerberos Applications Software Grid.
2. Acquire Kerberos Tickets:
   • Acquiring Kerberos Tickets in Mac OS X Mavericks (10.9) and later
   • MIT Kerberos for Windows 4.x - Getting Kerberos Tickets

Configuring Your Browser

Firefox

Debathena machines already have this configuration in place.

1. Open Firefox
2. In the address field, type about:config, and press Return
3. In the Filter field, start typing "network.neg..." to narrow the list and find network.negotiate-auth.trusted-uris
4. Double-click network.negotiate-auth.trusted-uris
5. In the dialog box text field, enter the URI: https://idp.mit.edu
6. Click OK to set Touchstone as a trusted URI for authentication
7. On Windows machines using Kerberos for Windows, you will also need to set network.auth.use-sspi to "false", as follows
8. Erase the previous text from the Filter field, start typing use-sspi in it, and find "network.auth.use-sspi"
9. If the value of network.auth.use-sspi is "true", double-click it to toggle the value to "false"
   Result: Your browser should now be configured, please try to access a Touchstone-enabled site or test your settings here.

Internet Explorer, Microsoft Edge and Chrome on Windows

You must add the MIT Touchstone server (idp.mit.edu) to the "Local intranet security zone"; otherwise, when the login server initiates negotiation, IE will prompt for a username/password by default. This is true even for a WIN.MIT.EDU client machine, because it and the login server are in different domains (realms).

If you do not add Touchstone to the security zone, IE will display a username/password dialog when you attempt to authenticate with Kerberos tickets. Do not enter your username or password in this dialog. Click "Cancel" to dismiss it and let IE proceed to the Touchstone login page.

To add Touchstone to the security zone, perform the following steps:

1. From the Tools menu select -> Internet Options
2. Click on the Security tab
3. Select the Local intranet icon
4. Click the Sites... button below at right
5. Click the Advanced... button
6. Add the Touchstone server URI: https://idp.mit.edu to the zone
7. Click Close or OK in each dialog window
   Result: This sets Touchstone as a trusted URI for authentication within your intranet zone. Your browser should now be configured, please try to access a Touchstone-enabled site or test your settings here.

Additional configuration required for non-domain machines

On a non-WIN.MIT.EDU domain machine, additional configuration is required so that KfW operates on the native ticket cache. This can be done (once) by doing one of the following:

• From the Command Prompt, run ?kinit.exe -c MSLSA: <KerberosUserName> (gets a ticket in the native cache).
  
  or
  
  
• Get a ticket using the KfW UI, then from the command line run mit2ms (to copy the ticket to the native cache).

To change the default to acquiring tickets in the native cache, do one of the following:

• Select the native cache ticket in the KfW UI, then click the Make Default button,
  
  or
  
  
• Update the Registry key HKEY_CURRENT_USER\Software\MIT\Kerberos5\ccname
  to have the value "MSLSA:" (the default value of this key is "API:").

Chrome on MacOS

1. Open a Terminal window
2. Enter the command: defaults write com.google.Chrome AuthServerWhitelist idp.mit.edu

Chrome on Linux

Run the following command at your command line:

• chrome --auth-server-whitelist="idp.mit.edu"

Safari

Does not require additional configuration once you install MIT Kerberos Extras (see above).

See Also

• Single sign-on Browser configuration
• MIT Touchstone Authentication Landing Page
• MIT Kerberos Accounts