Anthony Clark via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Please ignore, bad copy and paste.
Version 22 of the ipa.conf (the second pasted config section) is the one
that works correctly.
Is there a way to disable Kerberos browser-side popup password box in
version 27 of the ipa.conf file?
My apache configuration knowledge is not deep enough to answer your
question directly. However:
If I understand what you're asking: the error is caused by Windows
browsers (chrome, IE, and edge but not firefox) not handling GSSAPI
negotiate requests correctly. We have added a new feature to
mod_auth_gssapi for this - set the environment variable
BrowserMatch Windows gssapi-no-negotiate
and Windows clients will not see the box.
(This feature was added in mod_auth_gssapi version 1.6.0, which is in
fedora >= 27; this feature will also be a part of el7.5.)