Firefox tutorial: Firefox on your Intranet, configuring for transparent NTLM authentication

Firefox has had NTLM support for quite a while. NTLM is commonly used on Windows networks to authenticate access to various Intranet sites. You use NTLM to authenticate with an Active Directory domain controller, and you use these credentials to talk to Intranet sites. If you're a user of Internet Explorer, this is something you take for granted; it transparently authenticates you to Intranet sites that require authentication.

Firefox hasn't been able to do this transparently, it prompts you to enter your AD credentials for any Intranet site. Starting in the mid-August builds and finally in the 1.0PR build of Firefox, there is now support for transparent NTLM authentication. This overcomes a large hurdle of using Firefox in a corporate setting, that being the hassle of constantly needing to enter your credentials to browse any internal site.

Since this feature has been introduced to little fanfare, I'm writing this quickie tutorial on how to configure your Firefox for browsing your corporate Intranet without the constant authentication requests. In just a few easy steps, you'll have one less excuse to use IE.

Firefox has a configuration directive named network.automatic-ntlm-auth.trusted-uris. This can be accessed directly by typing about:config as a location. This configuration directive takes a comma-delimited list of Intranet site-names. It would look like:

corpweb,somesite,payroll,humanresources,infotech

No http:// or anything, just the host-name. You'll magically be able to go to those sites without the need to enter your credentials ever again. It simply does what IE does and sends your locally cached credentials to the server you're trying to access.

The downside to this is two-fold. First, this is specific to the Win32 version of Firefox only. You can twiddle these knobs in other platformed versions of Firefox, but they are ignored. This is because of the Windows-specific way that credentials are stored and accessed. Secondly, yes, you have to maintain a list of sites. This is unfourtunate, but it's because unlike Internet Explorer, Firefox has no concept of what an Intranet is. Perhaps in future versions, these options will become even more customizable with the ability to specify netmasks or IP ranges, but for now, you're stuck with this list of hostnames.

There's one other notable caveat (which cannot be blamed on Firefox), many corporate Intranet sites rely on things such as ActiveX controls and non-standard markup to render sites. So, it's wholly possible that many Intranet sites that work fine in IE won't work in Firefox anyway by sheer virtue of those sites not supporting standards, but at least you won't have to enter your credentials to find this out.

Firefox recognizes these configuration directives on the fly, so once you set something using about:config, you don't have to restart Firefox for it to take effect (obviously if you store the list in the user.js, then you're SOL).

Still, this is a big development as far as I'm concerned, and it brings Firefox one step closer to being a threat to the enterprise as well as the desktop.