Enabling Automatic Logon in Google Chrome Using Local Intranet Settings

Introduction

In enterprise environments or intranet scenarios, users often require seamless authentication to web applications using their Windows credentials. Internet Explorer (IE) traditionally supports this feature through the "Automatic logon with current user name and password" option under User Authentication. However, when transitioning to Google Chrome, users may encounter prompts for username and password, disrupting the workflow. This article addresses the challenge of enabling auto logon in Google Chrome by leveraging the Local Intranet security zone, similar to IE's approach.

Configuration via Local Intranet Settings

The primary method to enable automatic authentication in Chrome is by adding the target website to the Local Intranet zone in Windows Internet settings. This zone is configured to automatically send Windows credentials for authentication, typically using NTLM or Kerberos protocols. To achieve this in Chrome, follow these steps:

1. Open Chrome and navigate to Settings by clicking on the three-dot menu and selecting "Settings".
2. Scroll down to the bottom and click "Advanced" to expand additional settings.
3. In the "System" section, click on "Open proxy settings". In older versions, this may be under "Network" as "Change proxy settings".
4. This action opens the Windows Internet Properties dialog. Click on the "Security" tab.
5. Select the "Local intranet" icon, then click the "Sites" button.
6. Click "Advanced" to manually add sites.
7. Enter the URL of the website you wish to auto logon to, such as http://example.com or https://intranet.local, and click "Add".
8. Close all windows and restart Chrome if necessary. The browser should now automatically authenticate using Windows credentials when accessing the added sites.

This method works because Chrome utilizes the underlying Windows security settings, which treat Local Intranet sites as trusted for credential delegation.

Handling Version Differences in Chrome

Chrome's user interface has evolved over versions, necessitating slight adjustments to the navigation path. For example, in Chrome versions prior to 47, the settings might be accessed via "Under the Hood" and "Change proxy settings". The key is to locate the proxy settings option that opens the Windows dialog. Users can check their Chrome version by navigating to chrome://version and adjust the steps accordingly.

Alternative Approaches for Enhanced Control

Beyond the Local Intranet method, Chrome offers additional mechanisms for configuring authentication behavior. One option is to use the command-line switch --auth-server-whitelist to specify domains for automatic authentication. For instance, launching Chrome with --auth-server-whitelist="*example.com,*foobar.com" allows credential passthrough for those domains. However, this requires modifying shortcuts or startup scripts, which may not be persistent across sessions.

For enterprise deployments, the AuthServerAllowlist Group Policy provides a more stable solution. Administrators can download Chrome policy templates, enable the policy in Local Group Policy Editor, and configure allowed authentication servers. This ensures consistent behavior across machines and sessions without relying on manual settings. Steps include adding the policy template via gpedit.msc and enabling the policy under Google Chrome's HTTP Authentication section.

Security Considerations and Analysis

Enabling auto logon introduces security implications. By adding sites to the Local Intranet zone, users trust those domains with their Windows credentials, which could be exploited if the site is compromised. It is crucial to ensure that only legitimate intranet sites are added. Moreover, the use of wildcards in the whitelist or Local Intranet should be minimized to reduce attack surface.

NTLM authentication, commonly used in such scenarios, has known vulnerabilities such as relay attacks. Therefore, organizations should consider migrating to more secure protocols like Kerberos where possible. Chrome's integration with Windows security settings provides a balance between convenience and control, but proper configuration and monitoring are essential.

Conclusion

Enabling automatic user authentication in Google Chrome can be effectively achieved by configuring sites in the Local Intranet zone through the proxy settings. This method mirrors the functionality available in Internet Explorer and leverages existing Windows security infrastructure. For advanced use cases, command-line switches and Group Policy offer additional flexibility. By understanding and implementing these configurations, users and administrators can streamline access to intranet applications while maintaining security awareness.