<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=NL link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Hai, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Im having the following running. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Debian Jessie, squid 3.5.10
(recompiled from sid) with icap and authorisation agains a samba 4 AD DC. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>I begin with, this works great !..
so now my questions and the conf part for this. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>I am using the following
authentications. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>First Kerberos:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>auth_param negotiate program
/usr/lib/squid/negotiate_wrapper_auth -d \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> --kerberos
/usr/lib/squid/negotiate_kerberos_auth -s HTTP/hostname.domain.tld@KERB.REALM \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> --ntlm /usr/bin/ntlm_auth
--helper-protocol=gss-spnego --domain=NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>And this works also<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>#auth_param negotiate program
/usr/lib/squid/negotiate_wrapper_auth \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'># --kerberos
/usr/lib/squid/negotiate_kerberos_auth -s GSS_C_NO_NAME -d \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'># --ntlm /usr/bin/ntlm_auth
--helper-protocol=squid-2.5-ntlmssp --domain= NTDOMAIN \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>I use as fallback basic auth.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>auth_param basic program
/usr/lib/squid/basic_ldap_auth -R \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> -b "ou=SOMEOU,dc=internal,dc=domain.dc=tld"
\<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> -D ldap-bind@ KERB.REALM -W
/etc/squid/private/ldap-bind \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> -f
(|(userPrincipalName=%s)(sAMAccountName=%s)) \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> -h samba4-dc2.internal.domain.tld
\<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'> -h samba4-dc1.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>I know the following: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>## 1) Pure Kerberos. Passthrough
auth for windows users with windows DOMAIN JOINED pc's.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>## Fallback to Ldap for NON
WINDOWS NON DOMAIN JOINED Devices.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>## NO NTLM. AKA, a windows pc,
NOT JOINED in the domain, with end up in always user popup for auth.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>## Which will always fail
because of NTLM TYPE 1 and TYPE 2, authorisations.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>## 2) NEGOTIATE AUTH, which will
do all of above, but also authenticated Windows PC's Not domain Joined.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>When people access websites a see
a lot of : TCP_DENIED/407 <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Sometimes about 10-12 times the TCP_DENIED/407,
even when the user already access the website and it authenticated. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Is this because of pc’s
auth, or user auth, or by design as i did read here : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><a
href="http://www.squid-cache.org/mail-archive/squid-users/201310/0006.html">http://www.squid-cache.org/mail-archive/squid-users/201310/0006.html</a><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>acl AuthRequest http_status 407 <br>
access_log ... !AuthRequest ...<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>is this the only solution to
reduce the 407, or am i missing some setting here? <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>If you need more info, just ask.. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Greetz, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'>Louis<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>