topic Problems with IE and Kerberos in Intel® Business Client Software Development

Problems with IE and Kerberos

RBens2 — Mon, 21 Sep 2009 13:57:01 GMT

Hello All,

I'm trying to do some testing with AMT and Kerberos through Active Directory and I'm running into some issues with IE. I've got Kerberos working with DTK Commander and with the command line tools from the SDK, but I've been unable to get IE to connect to the WebUI on any of my test systems. I've tried XP, Vista, and Win7; and I've tried IE6, IE7, and IE8 - all to no avail. I know the docs talk about a KB fix for IE6, but I figured that IE7 or IE8 would work, but I haven't been able to get any of them to successfully authenticate to the ME. Any suggestions?

Thanks,
Roger

Re: Problems with IE and Kerberos

Richard_B_Intel1 — Mon, 21 Sep 2009 17:01:32 GMT

Quoting - rogerb

Hi Roger-

Are you receiving a specific error? If so, what is it? Also, is it the same errorwithall versions of IE?

Finally, per the "Intel AMT Integration with Active Directory" document provided with the SDK,have you added the domain(s) containing the Intel AMT systems to IE's list of trusted sites?

Re: Problems with IE and Kerberos

Lance_A_Intel — Mon, 21 Sep 2009 17:53:25 GMT

Hi Roger,
You may want to try the tips in this blog post.

Re: Problems with IE and Kerberos

RBens2 — Mon, 21 Sep 2009 21:39:35 GMT

I'm logged into the system as a domain admin, and I've got IE setup to use windows authentication, but I still can't get the system to authenticate with the AMT client. When I hit the Login button in the WebUI, I get a dialog box for entering my User id and password, I enter the domain userid and password, and it just returns without authenticating. Each time I reenter the password, it just comes back with a no authentication. I also setup the DNS domain to be a trusted site, and that didn't seem to make a difference. I thought that kerberos would allow me to not have to be prompted to enter a username and password, that it would just use the SID from my login to Windows to authenticate me to the AMT client through the Kerberos server. Why is it asking me for a username and password?

Thanks,
Roger

Re: Problems with IE and Kerberos

Richard_B_Intel1 — Wed, 23 Sep 2009 03:14:31 GMT

Roger-
I believe I have duplicated your situation; let me look into the issues.

Re: Problems with IE and Kerberos

Richard_B_Intel1 — Wed, 30 Sep 2009 16:53:06 GMT

Roger-

Sorry for the delayed response. It appears the IE6Hotfix documented in the "Intel AMT Integration with Active Directory" .pdf (KB908209) is still necessary for Kerberos to work with IE7 and IE8. With thisHotfix in place I was able to provision an AMT 5.x system with the SDK's ConfigurationServer example (Kerberos enabled indefault.conf.xml) and then access the system via the WebUI without re-entering User Name & Password.

Re: Problems with IE and Kerberos

Trevor_Sullivan — Wed, 30 Sep 2009 18:54:48 GMT

Quoting - rogerb

Roger,

Even though the hotfix itself is not applicable to IE7 and IE8, you still must apply the registry fix that is referenced in the KB article.

32-bit Platform
HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMainFeature ControlFEATURE_INCLUDE_PORT_IN_SPN_KB908209

64-bit Platform
HKEY_LOCAL_MACHINESoftwareWow6432NodeMicrosoftInternet ExplorerMainFeature ControlFEATURE_INCLUDE_PORT_IN_SPN_KB908209

Data Type: REG_DWORD

Value Name: iexplore.exe

Value: 01

Trevor Sullivan
Systems Engineer
OfficeMax Corporation