Prevent SSO with Playwright - adfs

Question

Trying to write an automated test for a website that uses federated auth with ADFS.
In my Ci/CD pipeline I will not be running in an authenticated Windows context so my Playwright tests will encounter an ADFS credentials prompt, BUT when developing the tests we are working in an authenticated context and Windows Pass-through auth will kick in (NTLM is my guess).
How can I prevent that?
With a previous set of tests that I wrote using NightwatchJS the trick I used was to send a custom UserAgent string of a browser that is not registered in ADFS as being a browser that is supported for the NTLM challenge flow. (it was Opera Mini btw)
With Playwright the same trick doesn't work apparently, and I was hoping there is something better out there.
What I tried:
context = await browser.newContext({
userAgent: 'Opera/9.80 (Android; Opera Mini/12.0.1987/37.7327; U; pl) Presto/2.12.423 Version/12.16'
})

Answer 1

So.....after some more digging, after asking the correct question, which in the end was:
"How to disable Windows Integrated Authentication in Chrome?"
I found this checklist for conditions and this answer on SO.
The fix was to add a startup arg to chromium to disable WIA. Here's the important bit below:
browser = await chromium.launch({
args: ['--auth-server-whitelist="_"'],
});
This will make chrome present a basic auth prompt for credentials.
However, when I combined this with the custom userAgent string that is not amongst the useragents supported by the ADFS server, I managed to reach the login page of ADFS.
Again, OperaMini worked for me:
context = await browser.newContext({
userAgent: 'Opera/9.80 (Android; Opera Mini/12.0.1987/37.7327; U; pl) Presto/2.12.423 Version/12.16'
})

Answer 2

What worked for me is to combine a bit of #dutzu's answer with basic authentication for Playwright. Here's an example of doing this in C# for AD/NTLM authentication.
using var playwright = await Playwright.CreateAsync();
await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
{
// Forces authentication to be required and not automatically passed through via your windows session
Args = new[] { "--auth-server-whitelist=\"_\"" },
Headless = false
});
var context = await browser.NewContextAsync(new BrowserNewContextOptions { HttpCredentials = new HttpCredentials { Password = "....", Username = "...." } }) ;
var page = await context.NewPageAsync();
await page.GotoAsync("https://some_website_that_uses_ntlm/");

Answer 3

You need to send calls to the Web Application Proxy or setup an internal one. Wep Application Proxy does not support Windows Integrated Authentication.

Answer 4

I was also having an ADFS form that I needed to authenticate against. In my case it was enough to create a browser context with http credentials, and then it just worked by itself.
const context = await browser.newContext({
httpCredentials: {
username: 'bill',
password: 'pa55w0rd',
},
});
const page = await context.newPage();
await page.goto('https://example.com');
Ref: https://playwright.dev/docs/network#http-authentication