Kererbos double hop issue

[mark_1]

We have been running Zoom for some years but we have just moved our intranet server and have run into problems with the Kerberos double hop issue; we were on Zoom 7.1 so we upgraded to Zoom 8 but the problem still exists.
We get a 401 response in Zoom when we start indexing the intranet.
We did have a similar issue with Chrome and Firefox but have managed to tweak the settings to enable the delegation which makes the double hop to work (there is no problem with IE or Edge).

This link explains the problem and how to fix it in Firefox http://www.microhowto.info/howto/configure_firefox_to_authenticate_using_spnego_and _kerberos.html

I can't see any setting in Zoom to allow us to enable the delegation, can anyone tell me how to set this up?

[David]

Kerberos double hop issue

This is some kind of craft beer I presume.



We haven't looked at delegation (and to be honest after a quick survey of all our software engineers, no one is sure what it is in this context). Kerberos I have at least heard of, but we have never looked into what was required to make it work.

[mark_1]

A pint of double hop IPA would be most welcome thank you, delegation is enough to drive me to drink.

I don't know how Zoom works, does it have a web browser engine built in? A third party web browser might have some hooks for delegation like Firefox and Chrome do but if it is all built in house I guess it won't.

[Ray]

Zoom does not have a web browser built-in. It uses Libcurl to handle HTTP connections, but then crawls and parses the pages with an in-house engine.

[aah_cbri]

Zoom does not have a web browser built-in. It uses Libcurl to handle HTTP connections, but then crawls and parses the pages with an in-house engine.

I belive Libcurl supports Negotiate(Kerberos) http authentication so can Zoom be configured to use this?

[David]

We have never looked into what was required to make Kerberos work. No one (in ~18 years) has ever asked before for Kerberos support during indexing before. If there was a sudden new demand for it we would look at it. Otherwise it would need to be done as a paid custom development job.

Update: A quick bit of research today seems to show that support for Kerberos is not in the base Libcurl package. So there is no trivial solution.

[mark_1]

Thanks all; I suspect Kerberos may pop up again as people migrate to newer servers (as we have done).
But for now we are trying to side-step the problem by indexing a local mirror of the actual website.