Can't get Kerberos SSO functional with CefSharp.Wpf.NETCore 91.1.210

[lo-lo-o]

Hello, I'm working on a Windows 10 Net5.0 targeted C# project where I've to embed a browser in a WPF app to acces a Kerberos SSO'd site.
I opted for chromium engine rather than gecko, but I'm stuck. Here's what I tried to do, and, who knows, may be someone can give me some help to get rid of this problem.

With chrome browser everything is ok, just have to set policy in registry

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"AuthServerAllowlist"="*.mydomain"
"AuthNegotiateDelegateAllowlist"="*.mydomain"

Unfornately I saw that "CEF does not support Chromium registry-based policy."

So, working with CefSharp project solution, I tried to :

-Set this as a preference in \CefSharp-master\CefSharp.Example\Handlers\BrowserProcessHandler.cs:OnContextInitialized()

//I saw that there has been a renaming in google's code : white > allow, so I tried both
var success = context.SetPreference("auth.server_whitelist", "*.mydomain", out errorMessage);
success = context.SetPreference("auth.server_allowlist", "*.mydomain", out errorMessage);

Each one return errorMessage = "Trying to modify an unregistered preference"

-Set this as a command-line switch in \CefSharp-master\CefSharp.Example\CefExample.cs:Init

settings.CefCommandLineArgs.Add("auth-server-whitelist", "*.mydomain");
settings.CefCommandLineArgs.Add("auth-server-allowlist", "*.mydomain");

doesn't work too.
I tried to find a way to get the status of applied (or not) rules, as you get in chrome://policy/ but didn't find.
Any idea ?

By the way, great projects (Cef/CefSharp) !

[amaitland]

Did you try searching on https://magpcss.org/ceforum/index.php?

I've never had need of Kerberos auth so it's not something I've tried.

I tried to find a way to get the status of applied (or not) rules, as you get in chrome://policy/ but didn't find.

You can call GetAllPreferences(true); to get all the preferences. That's the closest equivalent thatI'm aware of.

settings.CefCommandLineArgs.Add("auth-server-allowlist", "*.mydomain");

For supported command line args they are the same as chromium. Only a subset are supported, it's unlikely they would rename a command line argument once it's implemented.

https://peter.sh/experiments/chromium-command-line-switches/#auth-server-whitelist

Generally I'd suggest confirming that the command line arg works with the CEF Sample application (cefclient), you can download a copy from https://cef-builds.spotifycdn.com/index.html#windows32

Check the debug.log file that's created at runtime.

[amaitland]

A quick search yields https://magpcss.org/ceforum/viewtopic.php?f=6&t=17450#p45042

Suggests you cannot use preferences currently, not clear that Kerberos auth actually works at the moment. Best to follow up there.

[lo-lo-o]

Thanks Alex for your reply.
I'm now struggling in my air-gapped environment to build the Cef project, but I'm near to succeed.
I'll keep this thread informed with my results, and if necessary open one under Cef
Thanks again

[amaitland]

As this isn't a CefSharp specific issue I'd suggest moving the discussion to ceforum. Then the CEF maintainer can participate.

[lo-lo-o]

Yes, I joined the discussion you mentioned
https://magpcss.org/ceforum/viewtopic.php?f=6&t=17450&start=10