Search squid archive

Re: Re: Kerberos with LDAP authentication failover and iTunes auth problems

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> The best is to configure Negotiate with the wrapper to cover Negotiate/NTLM
> and Negotiate/Kerberos and NTLM as "pure" NTLM for applications/clients
> which do not support Negotiate but NTLM ( like some chat tools).

Thank you both for the feedback and help with my understanding on
authentication.  I installed negotiate_wrapper (running squid 3.1) and
after some initial problems trying to implement the use of ntlm_auth
post kerberos configuration I have it working now.

I have a concern that can hopefully be cleared up...

Because I implemented Kerberos first I already had a machine account
in Active Directory that was created by the msktutil utility.
When I researched implementing ntlm_auth the documentation mentions
joining the computer to AD using "net ads join".  This was an issue
because I already had the computer account and didn't want to hose
anything that the Negotiate/Kerberos might use and researched how to
use a pre-existing computer account in AD but could not find anything,
so in the end I just ran it (which worked).  However after I did this
Negotiate/Kerberos was broken.  I fixed it by resetting the computer
account and running "msktutil --auto-update" to update the computer
accounts password.  NTLM still worked after this.

I have a cron job setup to run "msktutil --auto-update" each day to
update the computer account's password when required.  Will these two
mechanisms interfere with each other in future?  i.e. is there
anything that the msktutil --auto-update might break for the winbind
ntlm_auth and visa versa - if this is a dumb question I apologise but
my knowledge on this is limited.

Also iTunes still prompts for a password but after input of the
username and password it works - I presume this is the expected
behaviour and that it shouldn't be seamless - is this the difference
between Negotiate/NTLM and pure NTLM?

Thanks

James


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux