"Brett Lymn" <brett.lymn@xxxxxxxxxxxxxx> wrote in message
news:20130221233448.GA749@xxxxxxxxxxx...
On Thu, Feb 21, 2013 at 11:23:32PM +0000, Markus Moeller wrote:
I don't think this has to do with squid and Kerberos.
Reasonably sure it does - for a start the machine that AD says is
causing the errors is one of the proxy servers and if we restart squid
on that particular machine the problem stops.
Hi Brett,
A pure squid Kerberos authentication setup does not create any connection
between squid and AD. I am 100% sure of that.
If you use additionally squid_kerb_ldap then yes there are connections. If
you use NTLM then there are connections too.
Markus
This is a Windows
client only issue. Usually the user should be prompted by Windows to
update the password. If the user does not update the password the client
won't get a Kerberos ticket and will fallback to NTLM if that also
doesn't
work it won't send anything to squid to authenticate.
That scenario does not match what we are observing, the user has changed
their password, they are able to (while the account is not locked out)
browse the web and access other internal resources. Our squid servers
don't do NTLM.
--
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited. If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility. It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."
