From a86ab44b5ce887a0975feac0589ce4834fdd2362 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 27 Oct 2026 13:03:55 +0100 Subject: [PATCH 1/3] feat: improve Authentication examples --- .vscode/project-words.txt | 1 + .../reference/policies/Authentication.mdx | 48 +++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/.vscode/project-words.txt b/.vscode/project-words.txt index 1060e15..542ff9b 100644 --- a/.vscode/project-words.txt +++ b/.vscode/project-words.txt @@ -49,6 +49,7 @@ msword network.dns.echconfig newtab nonsponsored +NTLM OCSP pbmode preventinstalls diff --git a/src/content/docs/reference/policies/Authentication.mdx b/src/content/docs/reference/policies/Authentication.mdx index cf253a6..2ad2940 100644 --- a/src/content/docs/reference/policies/Authentication.mdx +++ b/src/content/docs/reference/policies/Authentication.mdx @@ -25,6 +25,52 @@ See [Integrated authentication](https://htmlpreview.github.io/?https://github.co +### Enabling Kerberos single sign-on for an internal domain + +This example lets Firefox use Kerberos (SPNEGO) single sign-on with HTTPS sites on `example.com` and its subdomains, such as `https://intranet.example.com`. +The `https://` prefix keeps Firefox from offering Kerberos authentication over plain HTTP. +Because `Locked` defaults to `true`, users can't change the list: + +```json +{ + "policies": { + "Authentication": { + "SPNEGO": ["https://example.com"] + } + } +} +``` + +### Allowing Kerberos delegation to a single web app + +Some web apps, such as a reporting server that queries a database as the signed-in user, need Firefox to forward the user's Kerberos credentials. +This example allows SPNEGO for all of `example.com` but only permits delegation to `reports.example.com`. +Firefox only delegates to a site that SPNEGO already allows, so every site in `Delegated` must also match an entry in `SPNEGO`: + +```json +{ + "policies": { + "Authentication": { + "SPNEGO": ["https://example.com"], + "Delegated": ["https://reports.example.com"] + } + } +} +``` + +## Description + +Firefox matches each entry in `SPNEGO`, `Delegated` and `NTLM` against the end of the site's host name, on a dot boundary. +For example, `example.com` matches `example.com` and `intranet.example.com`, but not `myexample.com`. +An entry can also include a scheme, a port, or both: + +- `https://example.com` matches only HTTPS connections to `example.com` and its subdomains. +- `example.com:8443` matches only connections on port 8443. +- `https://` on its own matches every HTTPS site. + +`AllowProxies` controls authentication to proxies separately. +Firefox doesn't check proxies against these lists, and allows both SPNEGO and NTLM for proxies by default. + ## Windows (GPO) ``` @@ -95,3 +141,5 @@ Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0 ## See also - [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) +- [NTLM user authentication](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/ntlm-user-authentication) on learn.microsoft.com +- [SPNEGO](https://en.wikipedia.org/wiki/SPNEGO) on wikipedia.org From 22053583d17198fa85b31990b00680ef3150bd61 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Wed, 28 Oct 2026 12:15:41 +0100 Subject: [PATCH 2/3] feat: improve Authentication examples --- src/content/docs/reference/policies/Authentication.mdx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/content/docs/reference/policies/Authentication.mdx b/src/content/docs/reference/policies/Authentication.mdx index 2ad2940..ab7e005 100644 --- a/src/content/docs/reference/policies/Authentication.mdx +++ b/src/content/docs/reference/policies/Authentication.mdx @@ -28,7 +28,7 @@ See [Integrated authentication](https://htmlpreview.github.io/?https://github.co ### Enabling Kerberos single sign-on for an internal domain This example lets Firefox use Kerberos (SPNEGO) single sign-on with HTTPS sites on `example.com` and its subdomains, such as `https://intranet.example.com`. -The `https://` prefix keeps Firefox from offering Kerberos authentication over plain HTTP. +The `https://` prefix restricts this entry to HTTPS connections, so Firefox doesn't send Kerberos credentials to these sites over plain HTTP. Because `Locked` defaults to `true`, users can't change the list: ```json @@ -41,11 +41,12 @@ Because `Locked` defaults to `true`, users can't change the list: } ``` -### Allowing Kerberos delegation to a single web app +### Allowing Kerberos delegation to a reporting server Some web apps, such as a reporting server that queries a database as the signed-in user, need Firefox to forward the user's Kerberos credentials. -This example allows SPNEGO for all of `example.com` but only permits delegation to `reports.example.com`. -Firefox only delegates to a site that SPNEGO already allows, so every site in `Delegated` must also match an entry in `SPNEGO`: +This example allows SPNEGO for HTTPS sites on `example.com` and its subdomains, but only permits delegation to HTTPS sites on `reports.example.com` and its subdomains. +Delegation also requires SPNEGO authentication to be allowed for the site. +Here, the `SPNEGO` entry covers `reports.example.com`: ```json { From 30c1a5857648dbfae02f4c45f0a59197006ce1e2 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Wed, 28 Oct 2026 12:19:05 +0100 Subject: [PATCH 3/3] feat: improve Authentication examples --- src/content/docs/reference/policies/Authentication.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/reference/policies/Authentication.mdx b/src/content/docs/reference/policies/Authentication.mdx index ab7e005..b46450d 100644 --- a/src/content/docs/reference/policies/Authentication.mdx +++ b/src/content/docs/reference/policies/Authentication.mdx @@ -28,7 +28,7 @@ See [Integrated authentication](https://htmlpreview.github.io/?https://github.co ### Enabling Kerberos single sign-on for an internal domain This example lets Firefox use Kerberos (SPNEGO) single sign-on with HTTPS sites on `example.com` and its subdomains, such as `https://intranet.example.com`. -The `https://` prefix restricts this entry to HTTPS connections, so Firefox doesn't send Kerberos credentials to these sites over plain HTTP. +The `https://` prefix restricts this entry to HTTPS connections, so it doesn't allow Kerberos authentication over plain HTTP. Because `Locked` defaults to `true`, users can't change the list: ```json @@ -66,7 +66,7 @@ For example, `example.com` matches `example.com` and `intranet.example.com`, but An entry can also include a scheme, a port, or both: - `https://example.com` matches only HTTPS connections to `example.com` and its subdomains. -- `example.com:8443` matches only connections on port 8443. +- `example.com:8443` matches only connections to `example.com` and its subdomains on port 8443. - `https://` on its own matches every HTTPS site. `AllowProxies` controls authentication to proxies separately.