From: Michael Kaply Date: Wed, 22 Aug 2018 15:57:04 +0000 (-0700) Subject: Merge pull request #180 from mozilla/auth_fqdn X-Git-Tag: v1.2~20 X-Git-Url: https://git.p6c8.net/policy-templates.git/commitdiff_plain/11a18320359fb4e633ca790f8413b5fe57afe5c4?hp=-c Merge pull request #180 from mozilla/auth_fqdn Add support for non FQDN policy - Bugzilla 1471651 --- 11a18320359fb4e633ca790f8413b5fe57afe5c4 diff --combined README.md index 4b9cfc9,7e80eee..c0d8424 --- a/README.md +++ b/README.md @@@ -1,6 -1,4 +1,6 @@@ -Policies can either be specified using the Group Policy templates or by creating a file called policies.json. On Windows, create a directory called distribution where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. +**IMPORTANT**: This file is in active development along with the policies in Firefox. To get the policy information that corresponds to a specific release, go to https://github.com/mozilla/policy-templates/releases. + +Policies can either be specified using the Group Policy templates or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. The content of the JSON file should look like this: ``` @@@ -15,9 -13,9 +15,9 @@@ Policies are documented below **Note**: though comments are used in this readme file for documentation, comments are not valid in actual JSON files. Remove all comments before attempting to deploy. -Some of the policies are only available on the ESR for security reasons. These policies are marked ESR only. +Some of the policies were originally only available on the ESR for security reasons. As of Firefox 62, these policies are available outside of the ESR, but only via JSON file or a Local Machine-based Group Policy. User-based Group Policies are not allowed to set values for these policies. The descriptions below mark such policies as "Machine only". -### Authentication (ESR only) +### Authentication (Machine only) This policy is for configuring sites that support integrated authentication. See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information. ``` { @@@ -25,7 -23,11 +25,11 @@@ "Authentication": { "SPNEGO": ["mydomain.com", "https://myotherdomain.com"], "Delegated": ["mydomain.com", "https://myotherdomain.com"], - "NTLM": ["mydomain.com", "https://myotherdomain.com"] + "NTLM": ["mydomain.com", "https://myotherdomain.com"], + "AllowNonFQDN": { + "SPNEGO": true, + "NTLM": true + } } } } @@@ -75,7 -77,7 +79,7 @@@ This policy removes the "Set As Deskto } ``` ### Certificates -This is a Windows only policy that tells Firefox to read certificates from the Windows certificate store. +If this Windows only policy is set to true, Firefox reads certificates from the Windows certificate store. ``` { "policies": { @@@ -102,7 -104,7 +106,7 @@@ This policy controls various settings r } ``` ### DisableMasterPasswordCreation -This policy removes the master password functionality if set to true. +If this policy is set to true, the master password functionality is removed. ``` { "policies": { @@@ -110,7 -112,7 +114,7 @@@ } } ``` -### DisableAppUpdate (ESR only) +### DisableAppUpdate (Machine only) This policy turns off application updates. ``` { @@@ -138,7 -140,7 +142,7 @@@ This policy removes access to all devel } ``` ### DisableFeedbackCommands -This policy disables the menus for reporting sites (Submit Feedback, Report Deceptive Site) +This policy disables the menus for reporting sites (Submit Feedback, Report Deceptive Site). ``` { "policies": { @@@ -147,7 -149,7 +151,7 @@@ } ``` ### DisableFirefoxScreenshots -This policy removes access to Firefox Screenshots +This policy removes access to Firefox Screenshots. ``` { "policies": { @@@ -156,7 -158,7 +160,7 @@@ } ``` ### DisableFirefoxAccounts -This policy disables Sync +This policy disables Sync. ``` { "policies": { @@@ -165,7 -167,7 +169,7 @@@ } ``` ### DisableFirefoxStudies -This policy disables Firefox studies (Shield) +This policy disables Firefox studies (Shield). ``` { "policies": { @@@ -174,7 -176,7 +178,7 @@@ } ``` ### DisableForgetButton -This policy disables the "Forget" button +This policy disables the "Forget" button. ``` { "policies": { @@@ -183,7 -185,7 +187,7 @@@ } ``` ### DisableFormHistory -This policy turns off the browser.formfill.enable preferences +This policy turns off the browser.formfill.enable preferences. ``` { "policies": { @@@ -192,7 -194,7 +196,7 @@@ } ``` ### DisablePocket -This policy turns off Pocket +This policy turns off Pocket. ``` { "policies": { @@@ -201,7 -203,7 +205,7 @@@ } ``` ### DisablePrivateBrowsing -This policy removes access to private browsing +This policy removes access to private browsing. ``` { "policies": { @@@ -210,7 -212,7 +214,7 @@@ } ``` ### DisableProfileImport -This policy disables the"Import data from another browser" option in the bookmarks window. +This policy disables the "Import data from another browser" option in the bookmarks window. ``` { "policies": { @@@ -228,7 -230,7 +232,7 @@@ This policy disables the Refresh Firefo } ``` ### DisableSafeMode -This policy disables safe mode on Windows only +This policy disables safe mode on Windows only. ``` { "policies": { @@@ -248,7 -250,7 +252,7 @@@ This policy prevents the user from bypa } } ``` -### DisableSystemAddonUpdate (ESR only) +### DisableSystemAddonUpdate (Machine only) This policy prevents system add-ons from being updated or installed. ``` { @@@ -257,7 -259,7 +261,7 @@@ } } ``` -### DisableTelemetry (ESR only) +### DisableTelemetry (Machine only) This policy prevents the upload of telemetry data. Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours. @@@ -269,7 -271,7 +273,7 @@@ } ``` ### DisplayBookmarksToolbar -This policy turns on the bookmarks toolbar by default. A user can still turn it off and it will stay off. +This policy turns on the bookmarks toolbar by default. A user can still turn it off, and it will stay off. ``` { "policies": { @@@ -278,7 -280,7 +282,7 @@@ } ``` ### DisplayMenuBar -This policy turns on the menubar by default. A user can still turn it off and it will stay off. +This policy turns on the menubar by default. A user can still turn it off, and it will stay off. ``` { "policies": { @@@ -298,7 -300,7 +302,7 @@@ This policy stops Firefox from checkin ### EnableTrackingProtection This policy affects tracking protection. -If this policy is not configured, tracking protection is not enabled by default in the browser but it is enabled by default in private browsing and the user can change it. +If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it. If Value is set to false, tracking protection is disabled and locked in both the browser and private browsing. @@@ -312,9 -314,9 +316,9 @@@ If Value is set to true, private browsi } } ``` -### Extensions (ESR only) -This policy controls the install, uninstall and locking of extensions. Locked extensions cannot be disabled or uninstalled. -For Install, you can specify a list of URLs or paths. +### Extensions (Machine only) +This policy controls the installation, uninstallation and locking of extensions. Locked extensions cannot be disabled or uninstalled. +For Install, you specify a list of URLs or paths. For Uninstall and Locked, you specify extension IDs. ``` { @@@ -327,7 -329,7 +331,7 @@@ } ``` ### NoDefaultBookmarks -Don't create the default bookmarks or the Smart Bookmarks (Most Visited, Recent Tags). Note: this policy is only effective if used before the first run of the profile. +This policy prevents the default bookmarks or the Smart Bookmarks (Most Visited, Recent Tags) from being created. Note: this policy is only effective if used before the first run of the profile. ``` { "policies": { @@@ -344,7 -346,7 +348,7 @@@ This policy sets the signon.rememberSig } } ``` -### Homepage (ESR only) +### Homepage (Machine only) This policy sets the default homepage value. It can also be used to lock the homepage and add additional homepages. ``` { @@@ -359,7 -361,7 +363,7 @@@ } ``` ### PopupBlocking -This policy sets domains for which pop-up windows are allowed. It also set the default pop-up policy +This policy sets domains for which pop-up windows are allowed. It also sets the default pop-up policy. ``` { "policies": { @@@ -399,8 -401,8 +403,8 @@@ This policy sets the behavior of Flash } } ``` -### OverrideFirstRunPage (ESR only) -This policy allowed you to override the first run page. If you leave the URL blank, the first run page will not be displayed. +### OverrideFirstRunPage (Machine only) +This policy allows you to override the first run page. If you leave the URL blank, the first run page will not be displayed. ``` { "policies": { @@@ -408,8 -410,8 +412,8 @@@ } } ``` -### OverridePostUpdatePage (ESR only) -This policy allowed you to override the upgrade page page. If you leave the URL blank, the upgrade page will not be displayed. +### OverridePostUpdatePage (Machine only) +This policy allows you to override the upgrade page. If you leave the URL blank, the upgrade page will not be displayed. ``` { "policies": { @@@ -418,7 -420,7 +422,7 @@@ } ``` ### Bookmarks -This policy allows you to specify bookmarks. You can have any number of bookmarks although only ten are specified in the ADMX file. +This policy allows you to specify bookmarks. You can have any number of bookmarks, although only ten are specified in the ADMX file. Placement can be specified as either toolbar or menu. If a folder is specified, it is automatically created and bookmarks with the same folder name are grouped together. @@@ -469,7 -471,7 +473,7 @@@ If this policy is set to true, all dat } } ``` -### SearchBar (ESR only) +### SearchBar (Machine only) This policy can be used to determine if the search bar is separate or combined with the URL bar. ``` { @@@ -478,8 -480,8 +482,8 @@@ } } ``` -### WebsiteFilter (ESR only) -Blocks websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https accesses are supported at the moment. The arrays are limited to 1000 entries each. +### WebsiteFilter (Machine only) +This policy blocks websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. The arrays are limited to 1000 entries each. ``` { "policies": { @@@ -490,7 -492,7 +494,7 @@@ } } ``` -### Search Engines (ESR only) +### Search Engines (Machine only) This policy allows you to add new search engines, as well as set the default and prevent the install of search engines from web pages. Only Name and URLTemplate is required. ``` { diff --combined windows/en-US/firefox.adml index e5f23e6,a78edb3..eca45b3 --- a/windows/en-US/firefox.adml +++ b/windows/en-US/firefox.adml @@@ -1,11 -1,12 +1,12 @@@ - + Microsoft Windows XP SP2 or later - Firefox 60 or later + Firefox 60 or later, Firefox 60 ESR or later + Firefox 62 or later, Firefox 60.2 ESR or later Firefox 60 ESR or later Firefox Permissions @@@ -39,36 -40,41 +40,41 @@@ For more information, see https://devel If this policy is disabled or not configured, no websites are trusted to use NTLM authentification. For more information, see https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication. + Allow Non FQDN + If this policy is enabled, you can always allow SPNEGO or NTLM on non FQDNs (fully qualified domain names). + + If this policy is disabled or not configured, NTLM and SPNEGO are not enabled on non FQDNs. Block Add-ons Manager - If this policy is enabled, the user can not access the Add-ons Manager or about:addons. + If this policy is enabled, the user cannot access the Add-ons Manager or about:addons. If this policy is disabled or not configured, the user can access the Add-ons Manager and about:addons. Block about:config - If this policy is enabled, the user can not access about:config. + If this policy is enabled, the user cannot access about:config. If this policy is disabled or not configured, the user can access about:config. Block about:profiles - If this policy is enabled, the user can not access about:profiles. + If this policy is enabled, the user cannot access about:profiles. If this policy is disabled or not configured, the user can access about:profiles. Block Troubleshooting Information - If this policy is enabled, the user can not access Troubleshooting Information or about:support. + If this policy is enabled, the user cannot access Troubleshooting Information or about:support. If this policy is disabled or not configured, the user can access Troubleshooting Information and about:support. Disable Set Desktop Background - If this policy is enabled, the user can not set an image as their desktop background. + If this policy is enabled, the user cannot set an image as their desktop background. If this policy is disabled or not configured, users can set images as their desktop background. Import Enterprise Roots If this policy is enabled, Firefox will read certificates from the Windows certificate store. If this policy is disabled or not configured, Firefox will not read certificates from the Windows certificate store. + Disable Master Password Creation If this policy is enabled, users cannot create a master password. If this policy is disabled or not configured, users can create a master password. Disable Update - If this policy is enabled, the browser does not receive updates. + If this policy is enabled, the browser does not receive udpates. If this policy is disabled or not configured, the browser receives updates. Disable Built-in PDF Viewer (PDF.js) @@@ -130,7 -136,7 +136,7 @@@ If this policy is disabled or not confi If this policy is disabled or not configured, certificate errors can be overridden. Prevent overriding safe browsing errors - If this policy is enabled, a user can not bypass the warning and visit a harmful site. + If this policy is enabled, a user cannot bypass the warning and visit a harmful site. If this policy is disabled or not configured, a user can choose to visit a harmful site. Disable System Addon Updates @@@ -172,8 -178,8 +178,8 @@@ If this policy is disabled or not confi Offer to save logins If this policy is enabled or not configured, Firefox will offer to save website logins and passwords. -If this policy is disabled, firefox will not offer to save website logins and passwords. - If this policy is enabled, pop-up windows are always allowed for the URLS indicated. If a top level domain is specified (http://example.org), pop-up windows are allowed for all subdomains as well. +If this policy is disabled, Firefox will not offer to save website logins and passwords. + If this policy is enabled, pop-up windows are always allowed for the origins indicated. If a top level domain is specified (http://example.org), pop-up windows are allowed for all subdomains as well. If this policy is disabled or not configured, the default pop-up policy is followed. Allow pop-ups from websites @@@ -181,20 -187,20 +187,20 @@@ If this policy is not configured or enabled, popups are not allowed from websites. Do not allow preferences to be changed - If this policy is enabled pop-up preferences cannot be changed by the user. + If this policy is enabled, pop-up preferences cannot be changed by the user. If this policy is disabled or not configured, the user can change their pop-up preferences. - If this policy is enabled, add-ons are always allowed for the URLS indicated unless add-on install is disabled. If a top level domain is specified (http://example.org), add-ons are allowed for all subdomains as well. + If this policy is enabled, add-ons are always allowed for the origins indicated unless add-on install is disabled. If a top level domain is specified (http://example.org), add-ons are allowed for all subdomains as well. If this policy is disabled or not configured, the default add-on policy is followed. Allow add-on installs from websites If this policy is disabled, add-ons cannot be installed. If this policy is not configured or enabled, add-ons can be installed. - If this policy is enabled, cookies are always allowed for the URLS indicated. If a top level domain is specified (http://example.org), cookies are allowed for all subdomains as well. + If this policy is enabled, cookies are always allowed for the origins indicated. If a top level domain is specified (http://example.org), cookies are allowed for all subdomains as well. If this policy is disabled or not configured, the default cookie policy is followed. - If this policy is enabled, cookies are blocked for the URLS indicated. If a top level domain is specified (http://example.org), cookies are blocked from all subdomains as well. + If this policy is enabled, cookies are blocked for the origins indicated. If a top level domain is specified (http://example.org), cookies are blocked from all subdomains as well. If this policy is disabled or not configured, cookies are not blocked by default. Accept cookies from websites @@@ -213,13 -219,13 +219,13 @@@ This setting is ignored if this policy This setting is ignored if this policy is disabled or not configured or if cookies are not allowed. Do not allow preferences to be changed - If this policy is enabled cookie preferences cannot be changed by the user. + If this policy is enabled, cookie preferences cannot be changed by the user. If this policy is disabled or not configured, the user can change their cookie preferences. - If this policy is enabled, Flash is activated by default for the URLS indicated unless Flash is completely disabled. If a top level domain is specified (http://example.org), Flash is allowed for all subdomains as well. + If this policy is enabled, Flash is activated by default for the origins indicated unless Flash is completely disabled. If a top level domain is specified (http://example.org), Flash is allowed for all subdomains as well. If this policy is disabled or not configured, the default Flash policy is followed. - If this policy is enabled, Flash is blocked for the URLS indicated. If a top level domain is specified (http://example.org), Flas is blocked from all subdomains as well. + If this policy is enabled, Flash is blocked for the origins indicated. If a top level domain is specified (http://example.org), Flash is blocked from all subdomains as well. If this policy is disabled or not configured, the default Flash policy is followed. Activate Flash on websites @@@ -227,29 -233,29 +233,29 @@@ If this policy is disabled, Flash is never activated on websites, even if they are in the specified in the Allow list. -If this policy is not configured Flash, Flash is click to play. +If this policy is not configured, Flash is click to play. Do not allow preferences to be changed - If this policy is enabled Flash preferences cannot be changed by the user. + If this policy is enabled, Flash preferences cannot be changed by the user. If this policy is disabled or not configured, the user can change their Flash preferences. Override the first run page If this policy is enabled, you can specify a URL to be used as the first run page. If you leave the URL blank, no first run page will be shown. -If this policy is disabled or not configured the first run page is displayed. +If this policy is disabled or not configured, the first run page is displayed. Override the upgrade page If this policy is enabled, you can specify a URL to be displayed after Firefox is updated. If you leave the URL blank, no upgrade page will be shown. -If this policy is disabled or not configured the upgrade is displayed. +If this policy is disabled or not configured, the upgrade is displayed. Clear all data when browser is closed If this policy is enabled, all data is cleared when Firefox is closed. This includes Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data. If this policy is disabled or not configured, data is not cleared when the browser is closed. Blocked websites - If this policy is enabled, you can specify match patterns that indicate sites to be blocked. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https accesses are supported at the moment. There is a 1000 entry limit.", + If this policy is enabled, you can specify match patterns that indicate sites to be blocked. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. There is a 1000 entry limit. If this policy is disabled or not configured, no websites are blocked. Exceptions to blocked websites - If this policy is enabled, and the website filter is enabled, you can specify match patterns for sites you do not want to block. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https accesses are supported at the moment. There is a 1000 entry limit.", + If this policy is enabled, and the website filter is enabled, you can specify match patterns for sites you do not want to block. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. There is a 1000 entry limit. If this policy is disabled or not configured, there are no exceptions to the website filter. Bookmark One @@@ -259,7 -265,7 +265,7 @@@ Bookmark Five If this policy is enabled, you can configure a bookmark be added to Firefox. Due to a bug, you must select the location. Note that you must specify the bookmarks in order. -If this policy is not configured or disabled, a new bookmark is not added. +If this policy is disabled or not configured, a new bookmark is not added. Toolbar Menu No Default Bookmarks @@@ -303,7 -309,7 +309,7 @@@ If this policy is enabled, private brow Search bar location If this policy is enabled, you can set whether the search bar is separate from the URL bar. -If this policy is not configured or disabled, new users get a unified search bar, users upgrading from Firefox 56 and below get a separate search bar. +If this policy is disabled or not configured, new users get a unified search bar, users upgrading from Firefox 56 and below get a separate search bar. Search Engine One Search Engine Two Search Engine Three @@@ -311,24 -317,28 +317,28 @@@ Search Engine Five If this policy is enabled, you can configure a search engine to be added to Firefox. Use {searchTerms} to indicate where the search term is placed. Due to a bug, you must select the method (usually GET). Note that you must specify the search engines in order. -If this policy is not configured or disabled, a new search engine is not added. +If this policy is disabled or not configured, a new search engine is not added. Unified Separate GET POST Default Search Engine - If this policy is enabled, you can set type the name of a search engine to be used as the default. + If this policy is enabled, you can set the name of a search engine to be used as the default. -If this policy is not configured or disabled, the Firefox default engine is used. +If this policy is disabled or not configured, the Firefox default engine is used. Prevent Search Engine Installs If this policy is enabled, the user cannot install search engines from web page. -If this policy is not configured or disabled, search engines can be installed from web pages. +If this policy is disabled or not configured, search engines can be installed from web pages. + + Always allow NTLM on non FQDNs + Always allow SPNEGO on non FQDNs + diff --combined windows/firefox.admx index f4ca95b,fda3d86..1be3b6e --- a/windows/firefox.admx +++ b/windows/firefox.admx @@@ -4,7 -4,7 +4,7 @@@ - + @@@ -70,6 -70,28 +70,28 @@@ + + + + + + + + + + + + + + + + + + + + + +