<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV>Hi,</DIV>
<DIV> </DIV>
<DIV> 1) Yes, you should see <A
href="mailto:user@DOMAIN">user@DOMAIN</A> for kerberos authentication, but if
you use –r the @DOMAIN will be removed. </DIV>
<DIV> </DIV>
<DIV> 2) The client in EXTERNAL.COM needs to know where
to find the HTTP/<fqdn>@FATHER.COM principal. I think your trust is
not fully setup. You should see some cross domain TGTs. </DIV>
<DIV> </DIV>
<H2><FONT face="Times New Roman">Cross Domain SPN Lookups with Active
Directory</FONT></H2>
<P><FONT face="Times New Roman"><FONT style="FONT-SIZE: 12pt">When Domains are
within the same forest, the KDC should consult the GC (Global Catalog) and
provide a referral if the account is in a different domain. If the account
is not in the same forest you would need to define Host Mapping for the account,
unless you are using a forest trust. Then you could define a Kerberos
Forest Search Order</FONT></FONT></P>
<DIV> </DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"akn ab" <drcimino@mail.com> wrote in message
news:trinity-1231fb52-3516-493c-a2c9-b9fe1c1623c5-1458549367234@3capp-mailcom-lxa05...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV style="FONT-SIZE: 12px; FONT-FAMILY: verdana">
<DIV>
<DIV>Hello Markus,</DIV>
<DIV> </DIV>
<DIV>firt of all thank you for your reply, today i'm having a strange
issue.</DIV>
<DIV>KID1 and KID2 started to autenticate with kerberos correclty without any
modification ...</DIV>
<DIV>This is so strange, but i'm very happy, so i started others configurations,
but i have 2 more problems:</DIV>
<DIV> </DIV>
<DIV>1)</DIV>
<DIV>On my squid logs, i can see users authenticated correctly, but not the
domain users came from.</DIV>
<DIV>For example:</DIV>
<DIV>FATHER.COM\user1</DIV>
<DIV>KID1.FATHER.COM\user1</DIV>
<DIV>KID2.FATHER.COM\user1</DIV>
<DIV>are reported on my logs with "user1" and not in user1@kid1.father.com or
KID1\user1 (for example)</DIV>
<DIV>I need to differentiate domains because i'm sending x-authenticated-user to
my proxy peers.</DIV>
<DIV>Is it possible with kerberos?</DIV>
<DIV> </DIV>
<DIV>2)</DIV>
<DIV>I have another domain EXTERNALS.COM with bidirectional trust with
FATHER.COM, so i added it in my krb5.conf like KID1, but kerberos auth
fail.</DIV>
<DIV>Using your instructions, i captured port 88 during handshake and i
get:</DIV>
<DIV> </DIV>
<DIV>eRR-C-PRINCIPAL-UNKNOWN</DIV>
<DIV> </DIV>
<DIV>User's PC belonging to EXTERNALS.COM are joined to EXTERNALS.COM</DIV>
<DIV> </DIV>
<DIV>Best Regards.</DIV>
<DIV>
<DIV
style="WORD-WRAP: break-word; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: #c3d9e5 2px solid; MARGIN: 10px 5px 5px 10px; PADDING-RIGHT: 0px; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space"
name="quote">
<DIV style="MARGIN: 0px 0px 10px"><B>Sent:</B> Saturday, March 19, 2016 at 12:28
AM<BR><B>From:</B> "Markus Moeller"
<huaraz@moeller.plus.com><BR><B>To:</B>
squid-users@lists.squid-cache.org<BR><B>Subject:</B> Re: [squid-users] NEGOTIATE
Kerberos Auth</DIV>
<DIV name="quoted-content">
<DIV>
<DIV>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: arial; COLOR: rgb(0,0,0)">
<DIV>Hi,</DIV>
<DIV> </DIV>
<DIV> Is you client a member of FATHER.COM or KID1.FATHER.COM
/ KID2.FATHER.COM ?</DIV>
<DIV> </DIV>
<DIV> Can you get a wireshark capture on your client on
port 88 ? You should see some TGS –REQs in the capture and I assume
also TGS-REPs with error messages. Can you share these error
messages ?</DIV>
<DIV> </DIV>
<DIV>Regards</DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: rgb(0,0,0); BORDER-BOTTOM-COLOR: rgb(0,0,0); PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: rgb(0,0,0) 4px solid; BORDER-RIGHT-COLOR: rgb(0,0,0)">
<DIV
style="FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: calibri; FONT-WEIGHT: normal; COLOR: rgb(0,0,0); FONT-STYLE: normal; DISPLAY: inline">
<DIV>"akn ab" <drcimino@mail.com> wrote in message
news:trinity-1aed7413-4936-4022-90fa-eac7e2d892ed-1458301713239@3capp-mailcom-lxa01...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: rgb(0,0,0); BORDER-BOTTOM-COLOR: rgb(0,0,0); PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: rgb(0,0,0) 4px solid; BORDER-RIGHT-COLOR: rgb(0,0,0)">
<DIV
style="FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: calibri; FONT-WEIGHT: normal; COLOR: rgb(0,0,0); FONT-STYLE: normal; DISPLAY: inline">
<DIV style="FONT-SIZE: 12px; FONT-FAMILY: verdana">
<DIV>Dear all,</DIV>
<DIV> </DIV>
<DIV>i'm having a problem in configuring my squid 3.5.15 with negotiated
kerberos authentication in my Mono Forest Multi Domains.</DIV>
<DIV> </DIV>
<DIV>My FATHER.COM is a forest with 2 children: KID1 and KID2.</DIV>
<DIV>Like this: FATHER.COM -> KID1.FATHER.COM</DIV>
<DIV>
-> KID2.FATHER.COM</DIV>
<DIV> </DIV>
<DIV>With actual configurazion, squid negotiated kerberos auth works with only
FATHER.COM but not when my users belongs to KID1 and KID2.</DIV>
<DIV>I readed some discussions on mailing list about forest, but cannot find a
definitive advice and procedure to authenticate childern domains users.</DIV>
<DIV> </DIV>
<DIV>My krb5.conf:</DIV>
<DIV>
<DIV>[logging]<BR>default = FILE:/var/log/krb5libs.log<BR>kdc =
FILE:/var/log/krb5kdc.log<BR>admin_server = FILE:/var/log/kadmind.log</DIV>
<DIV>[libdefaults]<BR>default_realm = FATHER.COM<BR>dns_lookup_realm =
false<BR>dns_lookup_kdc = false<BR>ticket_lifetime = 24h<BR>renew_lifetime =
7d<BR>forwardable = true<BR>default_keytab_name =
/usr/local/squid/etc/HTTP.keytab<BR>default_tgs_enctypes =
aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<BR>default_tkt_enctypes
= aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<BR>permitted_enctypes
= aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5</DIV>
<DIV>[realms]<BR>FATHER.COM = {<BR> kdc = dc1.father.com:88</DIV>
<DIV> kdc = dc2.father.com:88<BR> default_domain =
father.com<BR>}<BR>KID1.FATHER.COM = {<BR> kdc =
dc1.kid1.father.com:88<BR> kdc = dc2.kid1.father.com:88<BR>
default_domain = kid1.father.com<BR>}</DIV>
<DIV>KID2.FATHER.COM = {<BR> kdc = dc1.kid2.father.com:88<BR> kdc =
dc2.kid2.father.com:88<BR> default_domain = kid2.father.com<BR>}</DIV>
<DIV>[domain_realm]<BR>.father.com = FATHER.COM<BR>father.com =
FATHER.COM<BR>.kid1.father.com = KID1.FATHER.COM<BR>kid1.father.com =
KID1.FATHER.COM</DIV>
<DIV>.kid2.father.com = KID2.FATHER.COM<BR>kid2.father.com =
KID2.FATHER.COM</DIV>
<DIV>[capaths]<BR>KID1.FATHER.COM = {<BR> FATHER.COM = .<BR>}</DIV>
<DIV>KID2.FATHER.COM = {<BR> FATHER.COM = .<BR>}</DIV>
<DIV> </DIV>
<DIV>To join kerberous auth with FATHER.COM i did:</DIV>
<DIV># kinit user@FATHER.COM</DIV>
<DIV># msktutil -c -b "CN=Computers" -s HTTP/proxy1.father.com -h
proxy1.father.com -k /usr/local/squid/etc/HTTP.keytab --computer-name proxy1krb
--upn HTTP/proxy1.father.com --server dc1.father.com --enctypes 28 --verbose
-N</DIV>
<DIV> </DIV>
<DIV>On squid config i have:</DIV>
<DIV>auth_param negotiate program
/usr/local/squid/libexec/negotiate_kerberos_auth -r -k
/usr/local/sq<BR>uid/etc/HTTP.keytab -s HTTP/proxy1.father.com</DIV>
<DIV> </DIV>
<DIV>Doing so, all my users belonging to FATHER.COM can negotiate kerberos using
proxy1.father.com:8080 (this exact name. If i use an alias dns name, does not
work).</DIV>
<DIV> </DIV>
<DIV>Now i'm trying to add KID1 and KID2 users to krb auth.</DIV>
<DIV>As i sayed previously, i readed some posts but i cannot find correct
configuration to support my forest.</DIV>
<DIV>1) Someone say to add to HTTP.keytab KID1 and KID2. To do so i did:</DIV>
<DIV>- kinit user@FATHER.COM</DIV>
<DIV>- msktutil -c -b "CN=Computers" -s HTTP/proxy1.father.com -h
proxy1.father.com -k /usr/local/squid/etc/HTTP.keytab --computer-name
proxy1krb-kid1 --upn HTTP/proxy1.father.com --server dc1.kid1.father.com
--enctypes 28 --verbose -N</DIV>
<DIV>but this configuration give my an error authentication of my keytab or
ticketing problem. So i tryed:</DIV>
<DIV>- kinit user@KID1.FATHER.COM</DIV>
<DIV>but my user is an Enterprise Admin form FATHER.COM, so i cannot get the
ticket.</DIV>
<DIV> </DIV>
<DIV>After many, many and many hours, i need some advices to complete my
configuration.</DIV>
<DIV>Is there anyone that could help me?</DIV>
<DIV> </DIV>
<DIV>Many thanks in advance.</DIV></DIV></DIV>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR><A
href="http://lists.squid-cache.org/listinfo/squid-users"
target=_blank>http://lists.squid-cache.org/listinfo/squid-users</A></DIV></DIV></DIV></DIV>_______________________________________________
squid-users mailing list squid-users@lists.squid-cache.org <A
href="http://lists.squid-cache.org/listinfo/squid-users"
target=_blank>http://lists.squid-cache.org/listinfo/squid-users</A></DIV></DIV></DIV></DIV></DIV></DIV>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>http://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>