Re: Re: Re: Re: Re: squid_kerb_auth on mac os x

["Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx>]

Brian,

To clarify what I said the MIT Kerberos code on Mac does not support SPNEGO 
yet, but my squid_kerb_auth deals with that when HAVE_SPNEGO is NOT defined.

Markus

"Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx> wrote in message 
news:g5a9h9$j0p$1@xxxxxxxxxxxxxxxx
> Brian,
>
> Mac does not yet include  spnego code. Don't use -DHAVE_SPNEGO to compile 
> on Mac.
>
> Markus
>
> BTW If you download the cvs source from sourceforge at
> http://squidkerbauth.cvs.sourceforge.net/squidkerbauth you can use
> ./configure and it should check everything for Mac
>
> "Brian Kirk" <bekirk@xxxxxxxxx> wrote in message 
> news:6ac1d44b0807111631l718a0e10ub0cdc913bf6b0a55@xxxxxxxxxxxxxxxxx
> > I have done the following:
> >
> > 1. created a key on the KDC with the following command:
> > ktpass -princ HTTP/squidtest.hdq.xyz.com@xxxxxxxxxxx -pass password
> > -mapuser squidtest -out c:\temp\squidtest.HTTP.keytab
> >
> > 2. Setup the /etc/krb5.conf for our domain and realm.
> >
> > 3. I then copied the key to the linux box, set the permissions so it
> > is read only by squid, and ran the kutil command:
> > ktutil: rkt /opt/squid/etc/squidtest.HTTP.keytab
> > ktutil: wkt /etc/krb5.keytab
> > ktutil: q
> >
> > 4. I ran the kinit command and it seemed not to error:
> > kinit -k -t /opt/squid/etc/squidtest.HTTP.keytab 
> > HTTP/squidtest.hdq.xyz.com
> >
> > 5. Output from the klist is as follows:
> > klist
> > Ticket cache: FILE:/tmp/krb5cc_0
> > Default principal: HTTP/squidtest.hdq.xyz.com@xxxxxxxxxxx
> >
> > Valid starting     Expires            Service principal
> > 07/11/08 19:08:55  07/12/08 05:08:55  krbtgt/HDQ.XYZ.COM@xxxxxxxxxxx
> >        renew until 07/12/08 05:08:55
> >
> >
> > Kerberos 4 ticket cache: /tmp/tkt0
> > klist: You have no tickets cached
> >
> > 6. I created a token with the squid_kerb_auth_test.c program and
> > authenticated with it:
> > [root@squidtest tmp]# /opt/squid/libexec/squid_kerb_auth -d -i -s
> > HTTP/squidtest.hdq.xyz.com </tmp/kir1864.token
> > 2008/07/11 19:13:31| squid_kerb_auth: Got 'YR
> > YIIP1QYJKoZIhvcSAQICAQBugg/EMIIPwKADAgEFoQMCAQ6iBwMFAAAAAACjgg74YYI.............................................................................................................................................pfdL/itMByBZYZshBJQgRViHFQgCsPdrJGRE4ePTRwS25ejLg=='
> > from squid (length: 5415).
> > AF AA== kir1864@xxxxxxxxxxx
> > 2008/07/11 19:13:31| squid_kerb_auth: AF AA== kir1864@xxxxxxxxxxx
> > 2008/07/11 19:13:31| squid_kerb_auth: User kir1864@xxxxxxxxxxx 
> > authenticated
> >
> > 7. I recompiled squid_kerb_auth with the -DHAVE_SPNEGO:
> > gcc -o squid_kerb_auth -DHAVE_SPNEGO -D__LITTLE_ENDIAN__ -Ispnegohelp
> > squid_kerb_auth.c base64.c spnegohelp/derparse.c  spnegohelp/spnego.c
> > spnegohelp/spnegohelp.c  spnegohelp/spnegoparse.c -lgssapi_krb5 -lkrb5
> > -lcom_err
> >
> > 8. Added this to my squid startup script and restarted squid, note I
> > have the auth_param in my squid.conf also below:
> > /etc/init.d/squid:export 
> > KRB5_KTNAME=FILE:/opt/squid/etc/squidtest.HTTP.keytab
> > /etc/squid.conf:auth_param negotiate program
> > /opt/squid/libexec/squid_kerb_auth -d 9
> > /etc/squid.conf:auth_param negotiate children 1
> > /etc/squid.conf:auth_param negotiate keep_alive on
> >
> > 9. When I authenticate with IE 6, it goes to the basic authentication,
> > even with the "Enable Integrated Windows Authentication" checked, I
> > think I found that there is no way to do proxy kerberos authentication
> > with IE 6, if someone know differently let me know how.  With IE 7 I
> > do get the following in the cache.log:
> > 2008/07/11 17:55:12| squid_kerb_auth: Got 'YR
> > YIIQHwYGKwYBBQUCoIIQEzCCEA+gJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKK..............................................................................................................................................bfhfphT7/Qu6CVQNdsKIK5Neq/ULSjfWmDdhxag4ZFDH6/V9/EJnNoNS/BQPwIqEgyzK5+nkg'
> > from squid (length: 5511).
> > 2008/07/11 17:55:12| squid_kerb_auth: gss_accept_sec_context() failed:
> > A token was invalid. Mechanism is incorrect
> >
> > Can anyone help with this problem?
> >
> > Thank you,
> > Brian Kirk