First thought: https://access.redhat.com/site/docume.../sso-config-firefox.html More to come.

sorry for the long wait for my reply, vacation/holiday time intervened.

Thx for the link, but I've already been to that site - that's how I learned how to run FF w/enhanced logging and found the information about the error code I report above.

Just to be sure, I performed the configuration on a completely different machine. Good news is this time things did not blow up on the client side - the security context initialized just fine. In fact, on the new machine, FF did in fact send a Kerberos token rather than an NTLM token in response to the negotiate challenge. So that's good - there are remaining issues to get the whole thing working but they're on the CAS server side of things and have nothing to do with FF. One hurdle cleared.

However I still have the same question as above though: what is causing FF on the original machine to return a NTLM token in response to the negotiate challenge when FF on the new machine returns a Kerberos token? Is there some config parameter I'm missing? How does FF decide what kind of token to send back to a server once it's determined that yes, this server is one listed in the network,negotiate-auth.trusted-uris?

As much as the forum knows about Network connection: https://support.mozilla.org/en-US/kb/advanced-settings-browsing-network-u...

I am wondering if there was a change that the old NTLM token may still be a cached preference? "Override automatic cache management:" in that article may help determine if the old machine does have the NTLM token cached.

I also asked an expert, and they recommended the best way to check if it is a preference that has be cached on the 1st machine is to create a new profile and test it in the new profile. Profile Manager - Create, remove or switch Firefox profiles

I hope this puts you in the right direction.

You can remove all data stored in Firefox from a specific domain via "Forget About This Site" in the right-click context menu of an history entry ("History > Show All History" or "View > Sidebar > History") or via the about:permissions page.

Using "Forget About This Site" will remove all data stored in Firefox from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious and if you have a password or other data from that domain that you do not want to lose then make a note of those passwords and bookmarks.

You can't recover from this 'forget' unless you have a backup of the involved files.

It doesn't have any lasting effect, so if you revisit such a 'forgotten' website then data from that website will be saved once again.

Thx to you both - I created a completely new profile in FF to eliminate the possibility of a cached NTLM token. Unfortunately, that didn't help - I still get an NTLM token from the original machine.

And just to be clear - the failing machine it still throwing the error I describe in the original post, e.g. the FF's call to function InitializeSecurityContext fails with a Windows return code of -2146893054. So while I can move on in the sense of "I have other machines that will allow me to hopefully get a successful Kerberos authentication configured and running", the one that is failing happens to be the standard desktop image that all users here in the corp office have. As such, I really need to figure out why FF is throwing that particular error so I can tell our corp desktop people what they need to do to our standard image before this whole thing will work.

That error is IIS Web Server error and in the past has been concluded to be a DNS error. Refhttps://bugzilla.mozilla.org/show_bug.cgi?id=489536

So I am reading more bugs with this error code and it happens in web auto proxies and thunderbird LAN only environment. Both are not related, but what they have in common is web server and the error is unicode? or it is not? Are you using two legged or multilegged? http://msdn.microsoft.com/en-us/libra.../aa375512%28v=vs.85%29.aspx

It looks like that error code can be deciphered in that documentation as well. Are you using a proxy in your environment? https://bugzilla.mozilla.org/show_bug.cgi?id=276094

If you are using a proxy please check the ISA configuration, are both computers using the proxy?

I also found some plug ins that you can try if the isa configuration just will not work. However finding the root of the issue for the difference between the two computers may be the key to why one does not work over the other.

• http://code.google.com/p/firefox-ntlmauth/
• https://addons.mozilla.org/en-US/firefox/addon/integrated-auth-for-firefox/

Hope this helps.