Browser Hangs when receive WWW-Authenticate: Negotiate

Question

When IE or Chrome on Windows7 receives a response with "WWW-Authenticate: Negotiate " header it hangs for a few seconds.

I would assume it is making a network request to KDC and the request times out. It may be wrong assumption though.

Is the server keytab determines which KDC the browser queries?

Is there any way to debug this?

Thanks!

Answer 1

To answer your first question, avoid making the assumption that it is timing out finding a KDC - only a network capture can tell you that. While it may in fact, be doing that, it could also be failing over to using NTLM and then succeeding on that because Kerberos is broken somewhere.

To answer your second question, the keytab does not determine which KDC the browser queries. There is nothing inside a keytab which would do that. I placed an image of what an example keytab looks like at the bottom of this answer for you. Now, the KDC which gets queried is controlled by DNS. That process would only get over-ridden by values set inside a C:\Windows\krb5.ini - if that file exists - and it doesn't exist on Windows by default. To answer your last question you can debug this using Wireshark captures, filter on 'kerberos' in the WireShark search field to see what the Kerberos traffic may be doing, or not doing. That will tell you all you need to know.