Chrome For Mac User Agent
This is more as a note to myself. Out of the box ADFS does not have WIA enabled for most browsers. You need to add the UserAgent strings of browsers you wish to enable WIA for. Here is the cmdlet with the list of agents I currently use:
- Current user-agents have to do with a little bit of browsers history. When there was a fight between Firefox and Internet Explorer, Chrome appeared. Some websites would ask Firefox users to switch to Internet Explorer for better rendering (because their website was old and not compatible with Firefox) and some would advice Internet Explorer.
- NOTE: if some sites have problems after using a mobile user-agent, and won't switch back no matter what you spoof, you will need to switch the user-agent back to Chrome.and. clear your cookies for the sites to treat the browser normally again.
The Chrome (or Chromium/Blink-based engines) user agent string is similar to Firefox’s. For compatibility, it adds strings like KHTML, like Gecko and Safari. Chrome User Agent Strings Chrome Free open-source web browser developed by Google. Chromium is the name of the open source project behind Google Chrome, released under the BSD license. Click on any string to get more details Chrome 70.0.3538.77. Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36; Chrome 55.0.2919.83.
Estimates vary but perhaps a third of Mac users choose to use the Chrome browser on their Apple system for some reason. If that’s you, you'll benefit from the following tips.
Set-AdfsProperties-WIASupportedUserAgents@('MSIE 6.0','MSIE 7.0; Windows NT','MSIE 8.0','MSIE 9.0','MSIE 10.0; Windows NT 6','Windows NT 6.3; Trident/7.0','Windows NT 6.3; Win64; x64; Trident/7.0','Windows NT 6.3; WOW64; Trident/7.0','Windows NT 6.2; Trident/7.0','Windows NT 6.2; Win64; x64; Trident/7.0','Windows NT 6.2; WOW64; Trident/7.0','Windows NT 6.1; Trident/7.0','Windows NT 6.1; Win64; x64; Trident/7.0','Windows NT 6.1; WOW64; Trident/7.0','MSIPC','Windows Rights Management Client”,”Mozilla/5.0”,”Edge/12”,”Chrome”,”Vivaldi') |
This is based on this & this Microsoft Docs plus some other blog posts I read over the years. I will keep updating this blog post with any updates.
It might be better to replace “Chrome” above with “Windowss*NT.*Chrome”. I found this in the comments of this article. Useful so it only targets Chrome on Windows and not iOS/ Android.
Here’s the User Agent Strings from Safari on my iPhone, Mac Book, and Vivaldi on Windows.
- Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 Vivaldi/2.1.1337.36
How To Check User Agent In Chrome
Matching on “Windowss*NT.*Chrome” (which I think is regex and so should translate to the string Windows followed by zero or more spaces, followed by NT, followed by zero or more characters, followed by Chrome) will thus only pick the last User Agent String.
Some more things to be done for WIA to work. You must add your ADFS site to the Local Intranet zone of IE. Best to use Group Policy Preferences for this, pushing out a registry key. Under the HKCU hive you can push out a key “SoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomainsadfs.fqdn
” (or replace adfs with a * if you want *.fqdn to be matched), with a value of https
and data of DWORD 00000001 in hex. Chrome, and Chromium based browsers (such as Vivaldi, Edge, etc.) will use this list so WIA will work for them automatically.
This link from the Chromium page also mentions the SPN issue I encountered previously. The SPN generated will use the CNAME name if that exists, so better to use an A record with an IP address.
When a server or proxy presents Chrome with a Negotiate challenge, Chrome tries to generate a Kerberos SPN (Service Principal Name) based on the host and port of the original URI. Unfortunately, the server does not indicate what the SPN should be as part of the authentication challenge, so Chrome (and other browsers) have to guess what it should be based on standard conventions.
Chrome Os User Agent String
The default SPN is: HTTP/<host name>, where <host name> is the canonical DNS name of the server. This mirrors the SPN generation logic of IE and Firefox.