From bd56d773bab0a36e7fcd2a61e18a3a627ddaeb6c Mon Sep 17 00:00:00 2001
From: Michael Kaply <consulting@kaply.com>
Date: Thu, 5 Apr 2018 11:55:39 -0500
Subject: [PATCH] Implement Authentication policy

---
 README.md                  | 14 +++++++++++++-
 windows/en-US/firefox.adml | 10 ++++++++++
 windows/firefox.admx       | 24 ++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3242d4c..867fb97 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,19 @@ The content of the JSON file should look like this:
 }
 ```
 Policies are documented below.
-
+### Authentication
+This policy is for configuring sites that support integrated authentication. See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information.
+```
+{
+  "policies": {
+    "Authentication": {
+      "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
+      "Delegated": ["mydomain.com", "https://myotherdomain.com"],
+      "NTLM": ["mydomain.com", "https://myotherdomain.com"]
+    }
+  }
+}
+```
 ### BlockAboutAddons
 This policy removes access to about:addons.
 ```
diff --git a/windows/en-US/firefox.adml b/windows/en-US/firefox.adml
index d67882d..1738225 100644
--- a/windows/en-US/firefox.adml
+++ b/windows/en-US/firefox.adml
@@ -7,6 +7,7 @@
       <string id="SUPPORTED_WINXPSP2">Microsoft Windows XP SP2 or later</string>
       <string id="firefox">Firefox</string>
       <string id="Permissions_group">Permissions</string>
+      <string id="Authentication_group">Authentication</string>
       <string id="Bookmarks_group">Bookmarks</string>
       <string id="Popups_group">Popups</string>
       <string id="Cookies_group">Cookies</string>
@@ -15,6 +16,12 @@
       <string id="Homepage_group">Home page</string>
       <string id="Allow">Allow</string>
       <string id="Block">Block</string>
+      <string id="Authentication_SPNEGO">SPNEGO</string>
+      <string id="Authentication_SPNEGO_Explain">List of sites that are permitted to engage in SPNEGO authentication with the browser.</string>
+      <string id="Authentication_Delegated">Delegated</string>
+      <string id="Authentication_Delegated_Explain">List of sites for which the browser may delegate user authorization to the server.</string>
+      <string id="Authentication_NTLM">NTLM</string>
+      <string id="Authentication_NTLM_Explain">List of sites trusted to use NTLM authentification.</string>
       <string id="BlockAboutAddons">Block About Addons</string>
       <string id="BlockAboutAddons_Explain" >Block access to the Add-ons Mananger (about:addons).</string>      
       <string id="BlockAboutConfig">Block About Config</string>
@@ -101,6 +108,9 @@ If this policy is disabled, tracking protection is disabled and locked in both t
 If this policy is enabled, private browsing is enabled by default in both the browser and private browsing and you can choose whether or not to prevent the user from changing it.</string>
     </stringTable>
     <presentationTable>
+      <presentation id="Authentication">
+        <listBox refId="Authentication"/>
+      </presentation>
       <presentation id="PopupsAllow"><listBox refId="PopupsAllowDesc">Allow popups for websites</listBox></presentation>
       <presentation id="AddonsAllow"><listBox refId="AddonsAllowDesc">Allow add-ons for websites</listBox></presentation>
       <presentation id="CookiesAllow"><listBox refId="CookiesAllowDesc">Allow cookies for websites</listBox></presentation>
diff --git a/windows/firefox.admx b/windows/firefox.admx
index 9ff5205..351fabd 100644
--- a/windows/firefox.admx
+++ b/windows/firefox.admx
@@ -36,8 +36,32 @@
     <category displayName="$(string.Homepage_group)" name="Homepage">
       <parentCategory ref="firefox"/>
     </category>
+    <category displayName="$(string.Authentication_group)" name="Authentication">
+      <parentCategory ref="firefox"/>
+    </category>
   </categories>
   <policies>
+    <policy name="Authentication_SPNEGO" class="Both" displayName="$(string.Authentication_SPNEGO)"  key="Software\Policies\Mozilla\Firefox\Authentication\SPNEGO" explainText="$(string.Authentication_SPNEGO_Explain)" presentation="$(presentation.Authentication)">
+      <parentCategory ref="Authentication"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <list id="Authentication" key="Software\Policies\Mozilla\Firefox\Authentication\SPNEGO" valuePrefix=""/>
+      </elements>
+    </policy>
+    <policy name="Authentication_Delegated" class="Both" displayName="$(string.Authentication_Delegated)"  key="Software\Policies\Mozilla\Firefox\Authentication\Delegated" explainText="$(string.Authentication_Delegated_Explain)" presentation="$(presentation.Authentication)">
+      <parentCategory ref="Authentication"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <list id="Authentication" key="Software\Policies\Mozilla\Firefox\Authentication\Delegated" valuePrefix=""/>
+      </elements>
+    </policy>
+    <policy name="Authentication_NTLM" class="Both" displayName="$(string.Authentication_NTLM)"  key="Software\Policies\Mozilla\Firefox\Authentication\NTLM" explainText="$(string.Authentication_NTLM_Explain)" presentation="$(presentation.Authentication)">
+      <parentCategory ref="Authentication"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <list id="Authentication" key="Software\Policies\Mozilla\Firefox\Authentication\NTLM" valuePrefix=""/>
+      </elements>
+    </policy>
     <policy name="BlockAboutAddons" class="Both" displayName="$(string.BlockAboutAddons)" explainText="$(string.BlockAboutAddons_Explain)" key="Software\Policies\Mozilla\Firefox" valueName="BlockAboutAddons">
       <parentCategory ref="firefox"/>
       <supportedOn ref="SUPPORTED_WINXPSP2"/>
-- 
2.34.1