<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV>Hi,</DIV>
<DIV> </DIV>
<DIV> Is you client a member of FATHER.COM or KID1.FATHER.COM
/ KID2.FATHER.COM ? </DIV>
<DIV> </DIV>
<DIV> Can you get a wireshark capture on your client on
port 88 ? You should see some TGS –REQs in the capture and I assume
also TGS-REPs with error messages. Can you share these error
messages ? </DIV>
<DIV> </DIV>
<DIV>Regards</DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"akn ab" <drcimino@mail.com> wrote in message
news:trinity-1aed7413-4936-4022-90fa-eac7e2d892ed-1458301713239@3capp-mailcom-lxa01...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV style="FONT-SIZE: 12px; FONT-FAMILY: verdana">
<DIV>Dear all,</DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>i'm having a problem in configuring my squid 3.5.15 with negotiated
kerberos authentication in my Mono Forest Multi Domains.</DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>My FATHER.COM is a forest with 2 children: KID1 and KID2.</DIV>
<DIV>Like this: FATHER.COM -> KID1.FATHER.COM</DIV>
<DIV>
-> KID2.FATHER.COM</DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV>With actual configurazion, squid negotiated kerberos auth works with only
FATHER.COM but not when my users belongs to KID1 and KID2.</DIV>
<DIV>I readed some discussions on mailing list about forest, but cannot find a
definitive advice and procedure to authenticate childern domains users.</DIV>
<DIV> </DIV>
<DIV>My krb5.conf:</DIV>
<DIV>
<DIV>[logging]<BR>default = FILE:/var/log/krb5libs.log<BR>kdc =
FILE:/var/log/krb5kdc.log<BR>admin_server = FILE:/var/log/kadmind.log</DIV>
<DIV>[libdefaults]<BR>default_realm = FATHER.COM<BR>dns_lookup_realm =
false<BR>dns_lookup_kdc = false<BR>ticket_lifetime = 24h<BR>renew_lifetime =
7d<BR>forwardable = true<BR>default_keytab_name =
/usr/local/squid/etc/HTTP.keytab<BR>default_tgs_enctypes =
aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<BR>default_tkt_enctypes
= aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<BR>permitted_enctypes
= aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5</DIV>
<DIV>[realms]<BR>FATHER.COM = {<BR> kdc = dc1.father.com:88</DIV>
<DIV> kdc = dc2.father.com:88<BR> default_domain =
father.com<BR>}<BR>KID1.FATHER.COM = {<BR> kdc =
dc1.kid1.father.com:88<BR> kdc = dc2.kid1.father.com:88<BR>
default_domain = kid1.father.com<BR>}</DIV>
<DIV>KID2.FATHER.COM = {<BR> kdc = dc1.kid2.father.com:88<BR> kdc =
dc2.kid2.father.com:88<BR> default_domain = kid2.father.com<BR>}</DIV>
<DIV>[domain_realm]<BR>.father.com = FATHER.COM<BR>father.com =
FATHER.COM<BR>.kid1.father.com = KID1.FATHER.COM<BR>kid1.father.com =
KID1.FATHER.COM</DIV>
<DIV>.kid2.father.com = KID2.FATHER.COM<BR>kid2.father.com =
KID2.FATHER.COM</DIV>
<DIV>[capaths]<BR>KID1.FATHER.COM = {<BR> FATHER.COM = .<BR>}</DIV>
<DIV>KID2.FATHER.COM = {<BR> FATHER.COM = .<BR>}</DIV>
<DIV> </DIV>
<DIV>To join kerberous auth with FATHER.COM i did:</DIV>
<DIV># kinit user@FATHER.COM</DIV>
<DIV># msktutil -c -b "CN=Computers" -s HTTP/proxy1.father.com -h
proxy1.father.com -k /usr/local/squid/etc/HTTP.keytab --computer-name proxy1krb
--upn HTTP/proxy1.father.com --server dc1.father.com --enctypes 28 --verbose
-N</DIV>
<DIV> </DIV>
<DIV>On squid config i have:</DIV>
<DIV>auth_param negotiate program
/usr/local/squid/libexec/negotiate_kerberos_auth -r -k
/usr/local/sq<BR>uid/etc/HTTP.keytab -s HTTP/proxy1.father.com</DIV>
<DIV> </DIV>
<DIV>Doing so, all my users belonging to FATHER.COM can negotiate kerberos using
proxy1.father.com:8080 (this exact name. If i use an alias dns name, does not
work).</DIV>
<DIV> </DIV>
<DIV>Now i'm trying to add KID1 and KID2 users to krb auth.</DIV>
<DIV>As i sayed previously, i readed some posts but i cannot find correct
configuration to support my forest.</DIV>
<DIV>1) Someone say to add to HTTP.keytab KID1 and KID2. To do so i did:</DIV>
<DIV>- kinit user@FATHER.COM</DIV>
<DIV>- msktutil -c -b "CN=Computers" -s HTTP/proxy1.father.com -h
proxy1.father.com -k /usr/local/squid/etc/HTTP.keytab --computer-name
proxy1krb-kid1 --upn HTTP/proxy1.father.com --server dc1.kid1.father.com
--enctypes 28 --verbose -N</DIV>
<DIV>but this configuration give my an error authentication of my keytab or
ticketing problem. So i tryed:</DIV>
<DIV>- kinit user@KID1.FATHER.COM</DIV>
<DIV>but my user is an Enterprise Admin form FATHER.COM, so i cannot get the
ticket.</DIV>
<DIV> </DIV>
<DIV>After many, many and many hours, i need some advices to complete my
configuration.</DIV>
<DIV>Is there anyone that could help me?</DIV>
<DIV> </DIV>
<DIV>Many thanks in advance.</DIV></DIV></DIV><FONT face=Verdana></FONT>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>http://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>