On 16.02.2012 04:33, Mr J Potter wrote:
Hi Amos, Thanks for your help on this... I've had to change tack on this in light of what you have said and have now got NTLM authentication working. - any form of http authentication is going to kick up a login box - there is no way round this, right?
No. That is entirely up to the browser. Squid always sends the 407, but whether that goes through a SSO process or popup is up to the browser.
With , NTLM I am now getting the NTLM login 3 times before it lets me in (apparently this is normal)
Several 407 *messages* is normal yes. Popups? not so much. You should only ever see one of those (or not even one).
Can you recommend the best/least bad approach to go for here? I;m setting up a guest wireless system, and I just want a way to get (non domain) devices to get a chance to login to get an internet connection, but all the ways I've found have major flaws. - LDAP basic authentication works fine but is insecure - LDAP digest requires a new type of password hash to be set up in my directory services - NTLM requires 3 login attempts Or do I move away from http authentication entirely?
You have missed Kerberos. This is an upgrade from NTLM with less of the handshake messages and somewhat better security encryption. Most systems support it, but YMMV on a general access system.
Amos
