How to turn off windows integrated authentication in Chrome

Question

I used to be able to disable windows integrated authentication by updating the settings in IE. Recently this no longer works. Has something changed in recent versions of chrome? Is there a new way to turn this off?

Chrome version 46.0.2490.71

I used to use this setting in IE Internet Options -> Advanced -> uncheck 'Enable Windows Integrated Authentication'

Pendulous

Answer 1

I got this response from an internal admin and it seems to work.

I think the best we came up with was to create a shortcut to chrome.exe on your desktop and modify the target of the shortcut to be something like:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --auth-server-whitelist="_"

Edit: Corrected the path for misplaced backslashes. Note also the (x86), just in case.

Pendulous

Note that Chrome changed it to "--auth-server-allowlist" at some point. – Samaritan

I can't get this to work with [--auth-server-allowlist=""] or [--auth-server-whitelist=""] or [--auth-server-allowlist] it always knows the windows account and do not let you remove it. If you forget and remove all other accounts, it will just login directly with windows account without asking anything. – Needleful

Answer 2

Expanding on Daniel Trimble's answer, which worked for me:

I would like to help more people find this useful answer by adding a little more context. What is Integrated Windows Authentication, and why would you want to disable it?

Basically, Integrated Windows Authentication allows a browser such as Chrome to access credentials that are stored on your computer (for example, the password you use to log into your office computer) and use those same credentials to log you into a website (for example, a password-protected portion of your company's website). This occurs behind the scenes, without a visible password prompt.

The problem is that you may not want to be automatically logged into a particular website.

Example: I like to use Chrome as a test browser to see the "public" view of my company's website. Generally I log into our site in Firefox or IE, make changes there, and then view the site in Chrome to make sure my changes were "published" as intended.

Suddenly, one day, I could no longer stay signed out of my company's website in Chrome. Whenever I navigated to a password-protected page, instead of giving me a login prompt, Chrome would automatically sign me in to Microsoft SharePoint (my company's content-management system) and show me the "logged in" version of that page.

If something similar is happening to you, there are other, more obvious things you should try first. Start by clearing your saved passwords (Chrome menu button > Settings > Show advanced settings > Passwords and forms > Manage passwords).

Clearing my saved passwords didn't work for me, so I tried other things: cleared the cache, removed all cookies, reset Chrome's settings, uninstalled and reinstalled Chrome. I even visited a password-protected page in an Incognito window, but Chrome still signed me in automatically.

Finally I found this Stack Overflow page, which solved the problem. (Thank you, Daniel Trimble!) Integrated Windows Authentication was the culprit. IWA used to be turned off by default in Chrome; you had to enable it via a checkbox in your Internet Options (shared with IE). At some point in the recent past, Google apparently decided to enable IWA by default. The unfortunate part is that they did not provide an option under Chrome's Settings panel to disable it. At least there's this workaround!

Invariable

That is way too long for a comment, but answers that expand upon and explain other answers are a great resource. I've reworded yours a bit, to set it up as an answer. You may want to edit it for readability, though - it's a wall of text now. – Individuation

@Mogsdad, thanks so much for the help -- this is my first contribution to Stack Overflow! I edited my response for readability as you suggested. I realize it's still text-heavy, but it's as concise as I can make it now. – Invariable

It appears now, incognito mode will also block this, requiring you to login. – Raoul

Answer 3

How to disable Integrated Windows Authentication (IWA) for Chrome via Windows' Control Panel:

(This applies to both Internet Explorer and Chrome since Chrome uses system settings that are managed using Internet Explorer.)

1. Press Windows' Start button, type "Internet Options" to search, and click the one result, from the control panel
2. Go to the "Security" tab
3. Select "Local Intranet" and click on "Custom Level" button
4. Scroll to the "User Authentication" section at the bottom of the list and select "Prompt for user name and password"
5. Click Ok, Apply, and Ok to save changes
6. Close all instances of the IE browser to make the changes effective. Launch the browser again and access the application. A basic authentication challenge will be served.

Source: https://sso.cisco.com/autho/msgs/disable_IWA.htm

Heinrike

This worked for me. I have two Okta profiles and can now switch between the two without using Incognito Mode. – Unknown

Answer 4

I found out we had a windows policy that set the following registry key:

HKEY_CURRENT_USER\Software\Policies\Google\Chrome\AuthServerWhitelist

Deleting this key made Chrome prompt for a username and password for me.

More information about the registry keys.

Tartar

Answer 5

Great and all the above answers work perfect.!

To add more -- I found that google chrome (version 68.0.3440.106) has the GUI option for Windows integrated authentication, just like in IE, this worked for me :)

1. goto chrome://settings/
2. Show advanced settings...
3. In the "Network" section, click on "Change proxy settings..."
4. Chrome opens the internet properties window
5. in the security tab
6. Select Local Intranet and Click on "Custom Level" button
7. Scroll to bottom of the window to User Authentication section, select "Prompt for user name and password"
8. Click Ok, Apply and Ok to save changes.
9. close existing session and start a new chrome session.

Atronna

Answer 6

I confirm that Daniel Trimble solution works!
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --auth-server-whitelist="_"

It is the least intrusive solution, no need to change any operating systems settings, just adding parameter to the app.

Jesselyn

Answer 7

My answer, in august 2024, for simply auto-filling username and password ("old-school") and not ask for Windows (Hello) authentication in Chrome:

1. Go to chrome://password-manager/settings
2. Disable "Use Windows Hello when filling passwords" (you'll have to enter your Hello password one more time)
3. Done.

Note that this is a lot less secure of course, especially if you leave your computer unattended around others, so think about this choice.

Hope this helps anyone stumbling across this.

Salazar