Understanding AuthServerWhitelist and AuthNegotiateDelegateWhitelist chrome policy registers?

Question

What's the differences between these two chrome policy registers AuthServerWhitelist and AuthNegotiateDelegateWhitelist?

I started doubting when I've found out those two registers while I was trying to automate a login for an intra-net.

First I tried out with AuthServerWhitelist and it didn't work.

Then I set up both AuthServerWhitelist and AuthNegotiateDelegateWhitelist and it worked.

I cannot see right now what's the difference, although I read they have two different functions.

Chromium Policies list link

Thanks a lot in advance!!

Answer 1

The difference between the two is related to Kerberos, impersonation levels and the difference between impersonation and delegation.

In simple terms (I'm not an expert):

AuthServerWhitelist specifies which servers are allowed for integrated authentication. By default, however, this only supports impersonation not delegation. So, if you add a server to AuthServerWhitelist, you can, for example, log in to a website which can then impersonate your user. However, let's say that website would further want to connect and authenticate to an SQL Server database on behalf of your user. That would not work since this is delegation.

Adding the server additionally to AuthNegotiateDelegateWhitelist should enable that delegation use-case, provided you are using Kerberos (Negotiate) and everything has been set up correctly.