MicrosoftEdge / MicrosoftEdge/WebView2Feedback

Need Webview2 browser policy to enable Kerberos delegation

Open
#1,641 24 comments 2 reactions 3 assignees View on GitHub

@Lakshmisha-KS is already working on this.

Since Mar 3, 2025.

feature request tracked
Dominant language
PowerShell
Stars
526
Forks
67
PR merge metrics
No merged PRs in 30d

Description

I am the responsible developer for the Edge control in SAP Business Client. Our customers expect that they can use the same SSO mechanisms in our product as in standalone Edge or Chrome. Some applications, like SAP BI, use SPNEGO/Kerberos delegation. For security reasons, that feature is by default disabled in chromium based browsers, so an allow list has to be provided in the browser policy "AuthNegotiateDelegateAllowlist".

https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#authnegotiatedelegateallowlist

Webview2 ignores Edge browser policies and currently doesn't contain that policy in it's own set of policies. Previous chromium versions offered the command line switch "–auth-negotiate-delegatewhitelist", but afaik it has been removed. So currently we have no chance to pass the allow list.

Please either add "AuthNegotiateDelegateAllowlist" to the set of Webview2 browser policies, or provide an API to set the list programmatically. Maybe it would be a good idea to also cover the full set of Edge Http authentication policies:

https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#http-authentication

AB#44690405

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.