The loging popup problem in Windows browsers has made a reappearance. Over the last few days I was contacted twice by the Fedora Account System team. It's an old issue that popped up (no pun intended) over 4 years ago. See https://bugzilla.redhat.com/show_bug.cgi?id=1309041 for more details.

Since we couldn't get Chrome and MSFT to address the root issue, Simo and Robby added BrowserMatch gssapi-no-negotiate feature to mod_auth_gssapi. I propose to add a browser match to FreeIPA's Apache HTTPd configuration permanently. We might need a better browser match than just "Windows", though.

FAS got broken because the alternative FreeIPA client got broken by the workaround described at https://jdshewey.blogspot.com/2017/08/fixing-annoying-popup-in-freeipa.html . The FAS team removed the workaround from their Ansible playbook.

https://pagure.io/fedora-infrastructure/issue/9438 is another example of the issue that affects FAS systems.