How to configure the Chrome web browser to access TIBCO Spotfire Web Player using Kerberos for Delegation without parameters.

How to configure the Chrome web browser to access TIBCO Spotfire Web Player using Kerberos for Delegation without parameters.

When the TIBCO Spotfire Web Player is configured to use Kerberos for unconstrained delegation authentication, the Chrome web browser must be explicitly passed the Web Player server or domain. For this, the Chrome browser can be launched with the following parameters:

chrome.exe --auth-server-whitelist=".domain.com" --auth-negotiate-delegate-whitelist=".domain.com"

It is also possible to define this server whitelist in the registry to avoid having to launch Chrome with these parameters every time.

Follow these instructions when using Google Chrome. Note that you must create and set a registry key for Google Chrome.

1. The Spotfire Server you are connecting to must be located in the Intranet security zone.
2. In the Registry Editor, go to [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome].
3. Add the String Value AuthNegotiateDelegateWhitelist.
4. Modify AuthNegotiateDelegateWhitelist and add the URL to the Spotfire Web Player. For example, "AuthNegotiateDelegateWhitelist"="myserver,myotherserver,*.mydomain.local" 

Doc: Enabling delegated Kerberos for Google Chrome

• https://docs.tibco.com/pub/spotfire_server/7.11.0/doc/html/TIB_sfire_server_tsas_admin_help/GUID-369C017E-6EDF-4CCE-85B6-36B6A239DBA2.html

External: Chromium Projects developer page:

• http://dev.chromium.org/administrators/policy-list-3#AuthNegotiateDelegateWhitelist