title: Integrated Windows Auth (NTLM) on a Mac using Google Chrome or Safari
body: <p>An IIS7 Intranet site with Windows Authentication enabled. When hit from Chrome on windows the pass-through authentication works fine (no User / Password prompt), however, Chrome on a Mac you get a prompt. Since the internal network uses CAC/PKI no one has a password.</p>
  
  <p>I've tried toggling the Windows Authentication on the site to negotiate, but same user/pass prompt.</p>
  
  <pre><code>appcmd set config /section:windowsAuthentication /-providers.[value='Negotiate']
  </code></pre>
  
  <p>Anyone know a solution for Chrome on OS X?</p>
  
  <p><em>EDIT</em> </p>
  
  <p>OS X 10.6.8</p>
  
  <p>Centrify for Mac will be used to authenticate to the (Windows 2008 R2 ActiveDirectory) network via CAC.</p>
  
  <p><em>EDIT 2</em></p>
  
  <p>There is a proxy setup, but it gets bypassed for local intranet sites, so I don't think it is playing a role.</p>
  
  <p>Also tried using the <strong>--auth-server-whitelist</strong> command line switch, didn't work.</p>
  
  <p><em>EDIT 3</em></p>
  
  <p><strong>SOLUTION</strong></p>
  
  <pre><code>open 'Google Chrome.app' --args --auth-server-whitelist="*DOMAIN.TLD" --auth-negotiate-delegate-whitelist="*DOMAIN.TLD" --auth-schemes="digest,ntlm,negotiate"
  </code></pre>
  
  <p>Unfortunately Google Chrome for Mac has no way of specifying command line arguments on every load, so some sort of shell script will need to be made.</p>
  
  <p><strong>Running the following shell script at log in was the final solution to get around Chrome updates and extra doc icons.</strong></p>
  
  <pre><code>#!/bin/bash
  cd /Applications/Google\ Chrome.app/Contents/MacOS/
  if [ -f 'Google Chrome.bin' ];
  then
     echo "Already Modified"
  else
     sudo chmod u+wr ./
     sudo mv 'Google Chrome' 'Google Chrome.bin'
     sudo echo "#!/bin/bash" &gt; "Google Chrome"
     sudo echo 'exec /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome.bin --args --auth-server-whitelist="*DOMAIN.TLD" --auth-negotiate-delegate-whitelist="*DOMAIN.TLD" --auth-schemes="digest,ntlm,negotiate"' &gt;&gt; "Google Chrome"
     sudo chmod a+x 'Google Chrome'
     echo "NTLM Will now work in chrome"
  fi
  </code></pre>