I am trying to enable proxy authentication via Kerberos for Firefox. The setup is:
- Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets without problems)
- Microsoft Windows witness machine (on which Firefox runs fine with no ticket problem)
- CentOS 6.3 system with Firefox (the tests were performed with both the 10.0.1 ESR found in the CentOS package repositories and the 15.0.1 downloaded from Mozilla's website)
- BlueCoat proxy with Kerberos authentication enabled
For the moment, Firefox requests an element of a website, gets an HTTP error code of "407 Proxy Authentication Required" from the proxy, gets a ticket granting service (TGS) from the domain for the proxy and performs the request again while passing the ticket. The transaction runs fine.
However, when more elements are requested (in parallel), Firefox requests one more ticket per proxy connection. And this takes many DNS queries, Kerberos interactions with domain controllers and costs a lot of time (for example, the home page of Adobe takes several minutes to load and at the end, I have about 30 valid Kerberos tickets).
I am stuck on this since a while, and help would be greatly appreciated.
Minor information: the CentOS operating system is virtualized with VMware Player 3.1.3, but I do not think this would be a game changer.
Edit (Sept. 26, 2012)
I tried restricting Firefox into having only one proxy connection. This partly solves the issue as there is much more ticket reuse, but since Firefox closes connections once there is no more data to receive, tickets are still requested on activity resume.
This still does not solve the underlying issue. Possible explanations may be:
- different system Kerberos libraries that do not provide the same features (I can provide the list of yum packages installed on the system)
- Firefox bug on Linux (I would like to hear about someone having fully integrated Linux and Firefox with a Microsoft Active Directory), although it seems unprobable
- Kerberos library incompatibility with some SELinux rules (SELinux is enabled in enforcing mode) which would prevent the browser from _reading_ its own tickets in the credential cache, even though it can _write_ them.