Did you try my negotiate wrapper ? It is part of squid 3.2, but right now
only works with 3.1 ( I have an open bug for 3.2)
Markus
"Emmanuel Lacour" <elacour@xxxxxxxxxxxxxxx> wrote in message
news:20111209110446.GC11412@xxxxxxxxxxxxxxx...
On Thu, Dec 08, 2011 at 09:14:51PM +0100, Emmanuel Lacour wrote:
As negotiate is proposed and IE support it, it always try to
authenticate with negotiate and so it fails every time.
this is by design since XP SP2:
http://support.microsoft.com/kb/891559
I did not found any workaround.
here is a setup that I tested, which allow evry kind of auth, exept from
an IE client not in the AD domain:
auth_param negotiate program /usr/lib/squid3/negotiate_kerb_auth -d -s
GSS_C_NO_NAME
auth_param negotiate children 5
auth_param negotiate keep_alive off
auth_param ntlm program
/usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=TEST
auth_param ntlm children 5
auth_param ntlm keep_alive off
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R -b
"dc=test,dc=local" -D "cn=Administrator,cn=Users,dc=test,dc=local" -w
"xxxxx" -f sAMAccountName=%s -h win-hlbivo4bbdl.test.local -d
auth_param basic casesensitive off
auth_param basic children 5
auth_param basic realm Proxy TEST
NB: setting a default domain for ntlm allow users to just use the login,
without domain\ before
NB: keep_alive off, as written in the docs helps at least FF to not
prompt multiple time for auth
