Option to suppress Negotiate auth to certain clients

[petr-tichy]

It would be really nice to have an option to present only Basic without Negotiate authentication option straight away to certain clients, based for example on a request environment variable.
This would allow to solve the issue with Windows clients that aren't part of the server domain, which first try to authenticate with Negotiate authentication, presenting an extra dialog.
I tested the scenario by proxying the GSSAPI enabled server and removing the WWW-Authenticate: Negotiate and keeping only Basic headers.

[simo5]

We are thinking of introducing some sort of user-agent filtering, do you have suggestions on what would be the best way to go about this ?
We could leave the user-agent filtering as a free form/rege based rule tweakable by admins, or we could have some builtin filtering, not sure what would work best/be easier to use.

[simo5]

Circling in @frozencemetery as he had similar ideas recently.

[petr-tichy]

IMHO the best would be to use an environment variable and leave setting the variable to the server admin, where a BrowserMatch et al would help.

[frozencemetery]

For papering over the problem I'm concerned about, it's best to use a blacklist that supports wildcards/regexes. Whether we should structure it further than just matching the string I don't know; if we were to, we'd need to split out OS & version, browser name, and browser version (in case it's ever fixed) at very least.

I think we should default the blacklist to things we know are broken. It's probably best to make it configurable by admins as well, in case that list changes in the future.

[frozencemetery]

@petr-tichy, why do you prefer an environment variable rather than a config file line for this?

[simo5]

@frozencemetery apache already has the BrowserMatch as well SetEnvIf options. I think I tend to agree with @petr-tichy that we could simply use those to set up an env var to suppress Negotiate. We just need to define the env var and check for it in code, no new options is a plus to me.