47

My computer and user belonging to the domain, I want to connect to my NTLM-SSO-enabled intranet website http://intranet without providing a login/password.

How to do it with Mozilla Firefox?

Nicolas Raoul
  • 10,711
  • 18
  • 64
  • 102

5 Answers5

53
  • When accessing the relevant site you need to make sure you run Firefox as the Windows user you want to log on as. If you always log onto a workstation as a domain user then there is no issue, otherwise you may need to Shift + right-click the shortcut and choose Run as different user..., or setup a shortcut with your credentials saved
  • In Firefox, type about:config In the address bar and press return.
  • After the config page loads, in the filter box type: network.automatic. You should see a search result of network.automatic-ntlm-auth.trusted-uris
  • Modify network.automatic-ntlm-auth.trusted-uris by double clicking the row and enter the relevent site
  • Multiple sites can be added by comma delimiting them such as: https://your_SecureAuth_FQDN.com, https://www.replacewithyourintranetsite.com
  • Click OK. You may need to restart Firefox for changes to take effect.

This is based on numerous pages I found on the internet, including this Firefox support page

James P
  • 11,206
  • 5
  • 43
  • 50
  • 1
    this does not work. i have read the same thing on many pages. is there an update for firefox v30 – shorif2000 Jun 24 '14 at 15:12
  • 1
    @sharif: Try using the downloading the following add-on: https://addons.mozilla.org/en-US/firefox/addon/integrated-auth-for-firefox/ then click Tools->Integrated Authentication Sites and check the box at the bottom that says **Enable pass-through on all non-FQDN sites even if they aren't listed here** – James P Jun 24 '14 at 15:25
  • 2
    @sharif: The issue that affects Firefox 30 specifically is that insecure v1 of NTLM has been disabled by default. It could be that you need to use the about:config editor to set `network.negotiate-auth.allow-insecure-ntlm-v1` to be true. However, NTLMv1 is very old, so I'm not sure if you would be using it. Relevant link: https://developer.mozilla.org/en-US/Firefox/Releases/30/Site_Compatibility – James P Jun 24 '14 at 15:34
  • 1
    Nothing works so far. Whatever I try from all answers here, FF keeps popping that annoying dialog prompt with (already saved!) username and password. Very un-thought design on FF side, I must say... – Van Jone Sep 09 '15 at 14:04
  • 3
    Depending on the situation it might be worth trying with `network.automatic-ntlm-auth.allow-non-fqdn` set to true, although for me it still worked when set to false and not specifying a domain. Unfortunately Mozilla have made these settings far too numerous and complex – James P Sep 09 '15 at 14:39
20

To authenticate Firefox automatically through a proxy (avoiding NTLM prompt), you have to modify 3 parameters.

  • Open the page about:config (in the address bar)

Add your uris (separate with ,) in the following 3 parameters:

  • network.automatic-ntlm-auth.trusted-uris
  • network.negotiate-auth.delegation-uris
  • network.negotiate-auth.trusted-uris

and change it with the URL of your proxy redirection page, like http://myproxy.local

Modify

  • signon.autologin.proxy to be true

If you do it by script, be careful with the dots (.) and the dash (-) in the parameters. This is often the problem.

aloisdg
  • 307
  • 1
  • 5
  • 16
Olivier
  • 209
  • 2
  • 2
  • network.negotiate-auth.trusted-uris works for me. Eg. when https://subdomain1.companydomain.cz/identitity/auth is page where authentication through NTML is done, you have tu put value https://subdomain1.companydomain.cz (ie. protocol and full domain, without path). Note that values are comma (,) separated. – Michal Bernhard Apr 06 '18 at 08:27
  • Works perfectly for me. My organization uses windows based single sign-on. Tested on firefox v61.0.2 – Adarsh Aug 14 '18 at 11:30
5

The suggested solution with network.automatic-ntlm-auth.trusted-uris was not enough in my case. Then I tried the same in network.negotiate-auth.trusted-uris Now it works.

Robert Pagon
  • 59
  • 1
  • 1
  • 3
    Still not working: FF keeps popping that annoying dialog prompt with already saved username and password – Van Jone Sep 09 '15 at 14:01
4

This worked for me:

Change network.automatic-ntlm-auth.allow-non-fqdn to True and signon.autologin.proxy to True

Add yourcompanyname.com in:

network.automatic-ntlm-auth.trusted-uris
network.negotiate-auth.delegation-uris
network.negotiate-auth.trusted-uris

SQLGuru
  • 41
  • 1
1

I modified signon.autologin.proxy to be true (by double-clicking on the preference name) and changed network.negotiate-auth.trusted-uris to timecard.example.com and it's working for me, almost too well. When I sign out of the page, it takes me to a sign-in screen, where I'm instantly logged in again. But I can live with that. What is missing is a way to either (a) add another URI with a single click, or (b) use wildcards, such as *.example.com.

samwyse
  • 143
  • 1
  • 5