<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">Hi
Marcio,</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt"></FONT></FONT> </DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">That looks OK. TT
means the helper requires additional data from the client which I did not
prepare a test for. In my case I get the AF response.</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt"></FONT></FONT> </DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">#
/opt/squid-trunk/sbin/negotiate_kerberos_auth_test opensuse42.suse.home | awk
'{sub(/Token:/,"YR"); print $0}END{print "QQ"}' |
/opt/squid-trunk/sbin/negotiate_kerberos_auth -r -k squid.keytab -s
HTTP/opensuse42.suse.home</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">AF
oRQwEqADCgEAoQsGCSqGSIb3EgECAg== markus group=</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">BH quit
command</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt"></FONT></FONT> </DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt"> Anyway the basic
check looks good. You now just need to run the helper with squid. I will
see if I can create a test which deals with the TT response
too.</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt"></FONT></FONT> </DIV>
<DIV><FONT face=Calibri><FONT
style="FONT-SIZE: 12pt">Regards</FONT></FONT></DIV>
<DIV><FONT face=Calibri><FONT style="FONT-SIZE: 12pt">Markus</FONT></FONT></DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"Marcio Demetrio Bacci" <marciobacci@gmail.com> wrote in message
news:CA+0Tdyr+2jEL7p09yrtJQ516M-2uE-q=Zayd3F5J0A=25zcacQ@mail.gmail.com...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV dir=ltr>
<DIV>
<DIV>Hi Markus, thank you for help me.<BR><BR>When I type the klist command, the
result is:<BR><BR>Ticket cache: FILE:/tmp/krb5cc_0<BR>Default principal:
<A>robert@CMS.ENSINO.BR</A><BR>Valid
starting
Expires
Service principal<BR>28-08-2016 22:40:53 29-08-2016 08:40:53
krbtgt/<A>CMS.ENSINO.BR@CMS.ENSINO.BR</A><BR> renew until
29-08-2016 22:40:41<BR><BR>But, I have the following result to command
bellow:<BR>/usr/lib64/squid/negotiate_kerberos_auth_test <A
href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</A>| awk
'{sub(/Token:/,"YR"); print $0}END{print "QQ"}' |
/usr/lib64/squid/negotiate_kerberos_auth -r -s HTTP/<A
href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</A> <BR><BR>Result:<BR>TT
oYGbMIGYoAMKAQGhCAYGKwYBBQIFooGGBIGDBQEwFKESBBBDTUIuRU5TSU5PLkVCLkJSfmkwZ6ADAgEFoQMCAR6iERgPMjAxNjA4MjkwMTM2MDVaowUCAwK7P6QRGA8yMDE2MDgyOTAxMzYwNVqlBQIDBhpppgMCAQepFRsTPHVuc3BlY2lmaWVkIHJlYWxtPqoLMAmgAwIBAKECMAA=<BR>BH
quit command<BR><BR><BR>The HTTP/<A
href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</A> is in keytab
files<BR><BR>I don't have the "test_negotiate_auth.sh" file in
src/auth/negotiate/kerberos, but I have
/usr/lib64/squid/negotiate_kerberos_auth_test, thus I'm using it.<BR><BR>My
Linux distribution is CentOS 7<BR><BR></DIV>Regards,<BR><BR></DIV>Márcio<BR>
<DIV>
<DIV><BR><BR><BR></DIV></DIV></DIV>
<DIV class=gmail_extra>
<DIV> </DIV>
<DIV class=gmail_quote>2016-08-28 15:24 GMT-03:00 Markus Moeller <SPAN
dir=ltr><<A target=_blank>huaraz@moeller.plus.com</A>></SPAN>:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex">
<DIV dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV> </DIV>
<DIV>HI Marcio,</DIV>
<DIV> </DIV>
<DIV> The helper need a Kerberos token as input. Please have a
look at test_negotiate_auth.sh which is in src/auth/negotiate/kerberos
of the trunk version. The squid hostname must match the entry in your keytab
and you must have done kinit to authenticate against a Kerberos server (e.g.
AD) as user first.</DIV>
<DIV> </DIV>
<DIV>Regards</DIV>
<DIV>Markus </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"Marcio Demetrio Bacci" <<A
target=_blank>marciobacci@gmail.com</A>> wrote in message
news:CA+<WBR>0TdyqEAt4L5KO4zrJNJ1aUe64mY2Re<WBR>7z95KFdqW7Y8SV_qbg@mail.gmail.<WBR>com...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>
<DIV class=h5>
<DIV dir=ltr>
<DIV>
<DIV>I have trouble to authenticate Squid3 with kerberos in Samba4 domain. I'm
using CentOS 7 and Squid 3.3.8 (yum install squid)<BR><BR></DIV>
<DIV>When I type the bellow command in terminal:
<BR>/usr/lib64/squid/negotiate_<WBR>kerberos_auth -d -i -s
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR>john xyz@12345<BR><BR>I
have the following error:<BR>negotiate_kerberos_auth.cc(<WBR>315): pid=6364
:2016/08/27 10:44:33| negotiate_kerberos_auth: DEBUG: Got 'john xyz@12345'
from squid (length: 14).<BR>negotiate_kerberos_auth.cc(<WBR>362): pid=6364
:2016/08/27 10:44:33| negotiate_kerberos_auth: ERROR: Invalid request [john
xyz@12345]<BR>BH invalid request <BR><BR><BR>Here are my files
configuration:<BR><BR>/etc/krb5.conf<BR>[libdefaults]<BR>
default_realm = <A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR>[realms]<BR> <A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A> =
{<BR> kdc = <A href="http://dc1.cms.ensino.br:88"
target=_blank>dc1.cms.ensino.br:88</A><BR> admin_server = <A
href="http://dc1.cms.ensino.br"
target=_blank>dc1.cms.ensino.br</A><BR> default_domain = <A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A>
<BR> }<BR>[domain_realm]<BR> .<A
href="http://cms.ensino.br" target=_blank>cms.ensino.br</A> = <A
href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> <A
href="http://cms.ensino.br" target=_blank>cms.ensino.br</A> = <A
href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR><BR><BR><BR>Keytab name:
FILE:/etc/krb5.keytab<BR>KVNO Principal<BR>----
------------------------------<WBR>------------------------------<WBR>--------------<BR>
1 proxy-k$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1 proxy-k$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
proxy-k$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
host/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
host/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
host/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
host/<A>PROXY@CMS.ENSINO.BR</A><BR> 1 PROXY$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
PROXY$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1 PROXY$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
PROXY$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1 PROXY$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
proxy-k$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1 proxy-k$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
HTTP/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
HTTP/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
HTTP/<A>PROXY@CMS.ENSINO.BR</A><BR> 1
HTTP/<A>PROXY@CMS.ENSINO.BR</A><BR><BR><BR>Keytab name:
FILE:/etc/squid/PROXY.keytab<BR>KVNO Principal<BR>----
------------------------------<WBR>------------------------------<WBR>--------------<BR>
1 proxy-k$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1 proxy-k$@<A
href="http://CMS.ENSINO.BR" target=_blank>CMS.ENSINO.BR</A><BR> 1
proxy-k$@<A href="http://CMS.ENSINO.BR"
target=_blank>CMS.ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
HTTP/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR> 1
host/<A>proxy.cms.ensino.br@CMS.<WBR>ENSINO.BR</A><BR><BR><BR>/etc/sysconfig/squid<BR>#
default squid options<BR>SQUID_OPTS=""<BR># Time to wait for Squid to shut
down when asked. Should not be necessary<BR># most of the
time.<BR>SQUID_SHUTDOWN_TIMEOUT=100<BR># default squid conf
file<BR>SQUID_CONF="/etc/squid/squid.<WBR>conf"<BR><BR>KRB5_KTNAME=/etc/squid/PROXY.<WBR>keytab<BR>export
KRB5_KTNAME<BR><BR><BR></DIV>
<DIV>kinit and klist commands are OK.<BR></DIV>
<DIV> </DIV>Best Regards,<BR><BR></DIV>Márcio<BR>
<DIV>
<DIV>
<DIV> </DIV></DIV></DIV></DIV></DIV></DIV>
<HR>
______________________________<WBR>_________________<BR>squid-users mailing
list<BR><A target=_blank>squid-users@lists.squid-cache.<WBR>org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users"
target=_blank>http://lists.squid-cache.org/<WBR>listinfo/squid-users</A><BR></DIV></DIV></DIV></DIV></DIV><BR>______________________________<WBR>_________________<BR>squid-users
mailing list<BR><A>squid-users@lists.squid-cache.<WBR>org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users" rel=noreferrer
target=_blank>http://lists.squid-cache.org/<WBR>listinfo/squid-users</A><BR><BR></BLOCKQUOTE></DIV>
<DIV> </DIV></DIV>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>http://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>