[squid-users] Re: Kerberos auth and users in another AD domain

2011-12-09 Thread Markus Moeller
Did you try my negotiate wrapper ?  It is part of squid 3.2, but right now 
only works with 3.1 ( I have an open bug for 3.2)


Markus


Emmanuel Lacour elac...@easter-eggs.com wrote in message 
news:20111209110446.gc11...@easter-eggs.com...

On Thu, Dec 08, 2011 at 09:14:51PM +0100, Emmanuel Lacour wrote:



As negotiate is proposed and IE support it, it always try to
authenticate with negotiate and so it fails every time.



this is by design since XP SP2:

http://support.microsoft.com/kb/891559

I did not found any workaround.

here is a setup that I tested, which allow evry kind of auth, exept from
an IE client not in the AD domain:

auth_param negotiate program /usr/lib/squid3/negotiate_kerb_auth -d -s 
GSS_C_NO_NAME

auth_param negotiate children 5
auth_param negotiate keep_alive off

auth_param ntlm program 
/usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=TEST

auth_param ntlm children 5
auth_param ntlm keep_alive off

auth_param basic program /usr/lib/squid3/squid_ldap_auth -R -b 
dc=test,dc=local -D cn=Administrator,cn=Users,dc=test,dc=local -w 
x -f sAMAccountName=%s -h win-hlbivo4bbdl.test.local -d

auth_param basic casesensitive off
auth_param basic children 5
auth_param basic realm Proxy TEST



NB: setting a default domain for ntlm allow users to just use the login,
without domain\ before
NB: keep_alive off, as written in the docs helps at least FF to not
prompt multiple time for auth







Re: [squid-users] Re: Kerberos auth and users in another AD domain

2011-12-09 Thread Emmanuel Lacour
On Fri, Dec 09, 2011 at 06:31:07PM -, Markus Moeller wrote:
 Did you try my negotiate wrapper ?  It is part of squid 3.2, but
 right now only works with 3.1 ( I have an open bug for 3.2)
 

looks interesting, I'm going to grab it from last 3.2 sources and
compile it for 3.1. I'll let you know if it fixes one/all of my
authentications problems ;)


Re: [squid-users] Re: Kerberos auth and users in another AD domain

2011-12-09 Thread Emmanuel Lacour
On Fri, Dec 09, 2011 at 06:31:07PM -, Markus Moeller wrote:
 Did you try my negotiate wrapper ?  It is part of squid 3.2, but
 right now only works with 3.1 ( I have an open bug for 3.2)
 

Can you give me hints on how to build it for 3.1 ?