title: NTLM authentication to AD FS for non-IE browser without 'Extended Protection' switched off?
body: <p>When using NTLM authentication to AD FS 2.0, from Google Chrome or Firefox 3.5+ running on Windows, then this results in a repeated sign-in dialog and finally sign-in failure, with 'Audit Failure' events with "Status: 0xc000035b".</p>
  
  <p>This can be 'solved' by switching off 'Extended Protection' for the "/adfs/ls" web application in IIS.  This is documented in several places; see <a href="https://stackoverflow.com/questions/5436441/adfs-authentication-ie8-works-chrome-fails/5437077#5437077">my answer to another StackOverflow question</a> for details.</p>
  
  <p>My question is: How can one make NTLM authentication to AD FS work for these browsers <em>without</em> switching off 'Extended Protection'?  I mean, in Internet Explorer this works fine with 'Extended Protection' on, why don't Chrome or Firefox?  Or is this a Chrome/Firefox implementation bug/restriction, e.g., in their use of the Windows NTLM library?</p>
  
  <p><em>Update:</em> I should have mentioned that I'd like to do this without forcing people to make changes in their browser settings.</p>