Search squid archive

Re: squid 3.1.14 kerberos single sign on

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This looks like the client does not get a Kerberos token, which can have several reasons.

1) Is the proxy name used in the browser the fqdn used in the serviceprincipaname in AD e.g. HTTP/<fqdn> ? 2) Is the right encryption type used (Win7 / 2008 do not support DES out of the box)

Can you capture with wireshark the communication between your Win7 client and AD on port 88 ( Kerberos port ) and send me the capture file ?

Regards
Markus


"Ming Fu" <Ming.Fu@xxxxxxxxxxxxxx> wrote in message news:09177155B3E82945AD8AF1F744B326458A7E1581@es05co...
Hi,

I am trying to setup squid 3.1.14 on linux with Kerberos SSO against windows 2008 server and win7 client.
But both firefox 5.0.1 and IE 8 generate same log from squid.

Is this a problem with squid or the browsers?

---- squid logs ----
2011/07/25 10:54:29| Accepting  HTTP connections at [::]:3128, FD 31.
2011/07/25 10:54:29| HTCP Disabled.
2011/07/25 10:54:29| squid_kerb_auth: INFO: Starting version 1.0.5
2011/07/25 10:54:29| squid_kerb_auth: INFO: Starting version 1.0.5
2011/07/25 10:54:29| Loaded Icons.
2011/07/25 10:54:29| Ready to serve requests.
2011/07/25 10:55:40| squid_kerb_auth: DEBUG: Got 'YR TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==' from squid (length: 59). 2011/07/25 10:55:40| squid_kerb_auth: DEBUG: Decode 'TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==' (decoded length: 40).
2011/07/25 10:55:40| squid_kerb_auth: WARNING: received type 1 NTLM token
2011/07/25 10:55:40| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH received type 1 NTLM token'


--- HTTP exchange Firefox to squid -----
GET http://www.google.ca/ HTTP/1.1
Host: www.google.ca
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://www.google.ca/
Cookie: PREF=ID=c7a9ded9c38f7fe3:U=5104260d840ffece:FF=0:TM=1311350545:LM=1311350546:S=CwtXJNRFT1U2j2O8; NID=49=W5u6mljBsItvKL3sO3IeIPlhRWCzhZ29I_vbIPqWOlIGJkraxqtEfFdfCz2Hqs4HPrqf-O4eBSR6BUpyEfmw6CXbxQEnMDRnD8PRRVWLQbuJYgKsCwaUGJIf8sJWDGu7

HTTP/1.0 407 Proxy Authentication Required
Server: squid/3.1.14
Mime-Version: 1.0
Date: Mon, 25 Jul 2011 15:38:05 GMT
Content-Type: text/html
Content-Length: 3945
X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en-us
Proxy-Authenticate: Negotiate
X-Cache: MISS from squid.sit26.borderware.com
Via: 1.0 squid.sit26.borderware.com (squid/3.1.14)
Connection: keep-alive

GET http://www.google.ca/ HTTP/1.1
Host: www.google.ca
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://www.google.ca/
Cookie: PREF=ID=c7a9ded9c38f7fe3:U=5104260d840ffece:FF=0:TM=1311350545:LM=1311350546:S=CwtXJNRFT1U2j2O8; NID=49=W5u6mljBsItvKL3sO3IeIPlhRWCzhZ29I_vbIPqWOlIGJkraxqtEfFdfCz2Hqs4HPrqf-O4eBSR6BUpyEfmw6CXbxQEnMDRnD8PRRVWLQbuJYgKsCwaUGJIf8sJWDGu7 Proxy-Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==


Regards,
Ming




[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux