Client Requirements

The client side, where your web browser is running, should have a valid kerberos ticket in the current user session. A command like this will get one:

$ kinit user@EXAMPLE.COM
Password for user@EXAMPLE.COM:  

In addition your browser must be usually be configured to allow kerberos authentication for the domain.

Mozilla Firefox

Go to about:config and set the network.negotiate-auth.trusted-uris setting to your domain name preceeded by a dot, ie: .example.com

Google Chrome

Exit your browser completely, and start it with a command line like this: google-chrome --auth-server-whitelist=*example.com

Use a fully qualified server name (with the domain name at the end) to access Cockpit in your web browser.

If you wish to connect from one server to another in Cockpit using kerberos SSO, then you have to explicitly enable this in your web browsers.

Mozilla Firefox

Go to about:config and set the network.negotiate-auth.delegation-uris setting to your domain name preceeded by a dot, ie: .example.com

Google Chrome

Exit your browser completely, and start it with a command line like this: google-chrome --auth-server-whitelist=*example.com --auth-server-delegate-whitelist=*example.com