Bug 1332875

Summary: After Samba upgrade to 4.3.8, automatic NTLM auth stops working
Product: [Fedora] Fedora Reporter: David Woodhouse <dwmw2>
Component: firefoxAssignee: Martin Stransky <stransky>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: gecko-bugs-nobody, jhorak, pjasicek, stransky
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: firefox-46.0.1-4.fc24 firefox-46.0.1-4.fc23 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-05-16 16:18:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Accept 'AF' as well as 'KK' for ntlm_auth final response. none

Description David Woodhouse 2016-05-04 09:17:02 UTC
The latest Samba update is fixed so that /usr/bin/ntlm_auth will give the final response prefixed with 'AF TlRMTVNT…' instead of 'KK TlRMTVNT…'. It looks like Firefox doesn't like this, although it should have accepted either form.

With the new Samba, Firefox gives the challenge (from the server's 401) to ntlm_auth but never seems to submit a new HTTP request with the new token.

Comment 1 David Woodhouse 2016-05-05 07:52:24 UTC
Created attachment 1154119 [details]
Accept 'AF' as well as 'KK' for ntlm_auth final response.

This is the simple fix submitted upstream.

I've shipped a fix internally, from my scratch build at http://koji.fedoraproject.org/koji/taskinfo?taskID=13916488 since NTLM single-sign-on is fairly crucial for my desktop users. I couldn't do my expenses without fixing this :)

So I have no desperate need for a quick update to fix this (although others might, if they don't want to use the same build). But I'd be really grateful if the *next* Firefox update, when it happens, could also incorporate this patch and I don't need to do another build of my own. Thanks!

Comment 2 Martin Stransky 2016-05-10 12:48:04 UTC
Added to 46.0.1-3

Comment 3 Fedora Update System 2016-05-13 08:52:30 UTC
firefox-46.0.1-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-e5b72fe554

Comment 4 Fedora Update System 2016-05-13 08:52:37 UTC
firefox-46.0.1-4.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-a70f137ded

Comment 5 Fedora Update System 2016-05-15 06:57:12 UTC
firefox-46.0.1-4.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-a70f137ded

Comment 6 Fedora Update System 2016-05-16 15:24:00 UTC
firefox-46.0.1-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-e5b72fe554

Comment 7 Fedora Update System 2016-05-16 16:18:51 UTC
firefox-46.0.1-4.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2016-05-16 22:25:38 UTC
firefox-46.0.1-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.