On Sat, Mar 31, 2007, Stefan Adams wrote: > Hello squid developers! > > I have been devoting a lot of time to authentication within the proxy. > However, every solution I provide to my customers is unacceptable. > They simply get prompted too often or something doesn't work at all.
Erk! Hey, someone who might help fix why those Java applets break with NTLM/basic authentication! Quick, tie him down. :) > Using NTLM, certain sites, e.g. links to videos on cnn.com, don't work > at all. These videos are loaded by Real Player which apparently has > an issue working passing NTLM credentials. As such, when using NTLM > authentication, these videos are inaccessible. This is unacceptable > to customers. Have you any packet dumps/NTLM traces of this? It might be easily worked around by some patches to Squid. > Using Basic (PAM module), certain situations cause credential > querying. This is extremely evident while using the help function of > Microsoft Office products. The online help is web-based. Each link > loads a new browser window and Office does not remember the > credentials from link to link. As a result, everytime a customer > clicks a link, they are asked once again for credentials. This is > unacceptable to customers. Hm, does the online help, being web-based, does that work happy with NTLM? Does NTLM work well in this case? > I think entry 2.3 in the FAQ most clearly sums up the problem: > > http://netmirror.org/mirror/squid-www/Doc/FAQ/FAQ-23.html > > "Note: This has nothing to do with how often the user needs to > re-authenticate himself. It is the browser who maintains the session, > and re-authentication is a business between the user and his browser, > not the browser and Squid. The browser authenticates on behalf of the > user on every request sent to Squid. What this parameter controls is > only how often Squid will ask the defined helper if the password is > still valid." > > That said, there simply MUST be a better way. I have heard of other > schools that provide authentication to the proxy that apparently do > not complain about such "inconveniences". These users use commerical, > proprietary products. I have no idea how they work. Can you get access to them? Can you throw a packet trace at them? Its entirely possible to "cache" authentication based on IP address. That'd be perfectly fine in a lot of cases. My suggestion: get some traces from broken implementations, fire them off to the list, offer some money at people to try and fix it up and see what happens. Adrian
