I configured squid to use kerberos authentication but when I'm trying to use proxy with browser i don't get popup in browser with ask for user and password - just access denied cos of no authentication. Is it possible to configure "negotiate_kerberos_auth" to work such way?
Add a comment
|
4 Answers
No, Kerberos won't fallback to a prompt. NTLM will. Or Negotiate if you let it do NTLM. Surely the idea is to not have a prompt at all though if you're using kerberos?
answered Nov 20, 2015 at 20:48
-
I want to authenticate remote proxy users in kerberos (freeipa), users don't have locally kerberos client installed. Thought that will work same as NTLM and squid just will check if they can be authenticated in kerberos DB like NTLM is checking in the passwd file. Nov 20, 2015 at 21:11
if your squid just does kerberos, then this is normal behaviour. You could configure another acl to do ldap authentication if kerberos fails, but due to the limitations of the way proxy authentication works it will be plain text.
answered Nov 20, 2015 at 21:14
I solved my problem by using LDAP authentication instead of kerberos. Now i have pop up window in my browser and im authenticating with same login passwords which i have in my kerberos/LDAP (FreeIPA) configuration.
answered Nov 23, 2015 at 8:54
If anyone is interested on how the "ldap auth" is working, search for basic_ldap_auth, LDAP authentication helper for Squid, (see man page).
Basically, you need to add something like this to squid.conf:
auth_param basic program /usr/lib64/squid/basic_ldap_auth -b "cn=users,cn=accounts,dc=example,dc=com" -D "uid=proxy_user,cn=users,cn=accounts,dc=example,dc=com" -W /etc/squid/ldap_password -f "(&(objectClass=person)(uid=%s))" -H ldap://ldap_server.example.com:389
See RedHat docs for more info.
