<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hello Amos,</div>
<div> </div>
<div>auth_param ntlm keep_alive off</div>
<div> </div>
<div>unfortunately does not solve the problem.</div>
<div>I did more investigation about the problem and i found informations.</div>
<div>Every time a user get the browser popup requesting credentials, i found on squid log this event:</div>
<div> </div>
<div>
<div>Login for user [DOMAIN]\[user]@[PC_XXXX] failed due to [Access denied]<br/>
NTLMSSP BH: NT_STATUS_ACCESS_DENIED<br/>
2016/09/02 16:56:13 kid1| ERROR: NTLM Authentication validating user. Result: {result=BH, notes={message: NT_STATUS_ACCESS_DENIED; }}</div>
<div> </div>
<div>It's not easy to do more debug because i have 9000 concurrent connections, but if you think that can help me, i try to set debug_option to something like 29,5</div>
<div>Sometimes users left the office letting the browser open.</div>
<div>After 1 hour (more or less), they return to the pc and popup show as soos as mouse point to a new link on the open browser.</div>
<div>It's probably because something cached expire, but i cannot demostrate it so easily beceuse, as you said, ntlm never cache.</div>
<div>On my samba/winbind logs i see many</div>
<div>rpccli_netlogon_sam_network_logon: credentials chain check failed</div>
<div> </div>
<div>So it's very strange to understand if some problem occur beetween squid and browser or samba and Active Directory.</div>
<div> </div>
<div>What do you think about?</div>
</div>
<div>Thanks.</div>
<div> </div>
<div>Giulius.<br/>
<br/>
On 1/09/2016 12:37 a.m., akn ab wrote:<br/>
> Dear all,<br/>
> i'm facing a strange problem using squid 3.5.20 with ntlm transparent<br/>
> authentication.<br/>
> I cannot use kerberos auth because i need to pass DOMAIN\user to my parent proxy<br/>
> with x-authenticated-user header, and the form USERNAME@DOMAIN is not supported.<br/>
> Users can surf the web without problems but, sometimes, they receive request<br/>
> credential popup from browser (explorer, edge, mozilla and chrome it does not<br/>
> matter).<br/>
> auth_param ntlm program /usr/local/samba/bin/ntlm_auth<br/>
> --helper-protocol=squid-2.5-ntlmssp<br/>
> auth_param ntlm children 300 startup=200 idle=10 concurrency=0<br/>
> auth_param ntlm keep_alive on<br/>
> auth_param basic program /usr/local/samba/bin/ntlm_auth<br/>
> --helper-protocol=squid-2.5-basic<br/>
> auth_param basic children 25 startup=15 idle=5 concurrency=0<br/>
> auth_param basic realm PROXY AUTHORIZATION REQUIRED<br/>
> auth_param basic credentialsttl 30 minutes<br/>
> authenticate_cache_garbage_interval 1 hours<br/>
> authenticate_ttl 30 minutes<br/>
> authenticate_ip_ttl 30 minutes<br/>
><br/>
> I migrated from squid 2.6.x and, with similar configuration, the required<br/>
> credentials was displayed only when the password was expired.<br/>
> In this situation, users must click on abort button many times to restore a<br/>
> good situation, but i cannot understand why the request popup suddenly.<br/>
> Is this a credentials cache timeout problm (authenticate_ttl 30 minutes)?<br/>
<br/>
Maybe. If so its not an NTLM problem since NTLM credentials are "cached"<br/>
by being tied to the TCP connection state, not stored in a regular cache<br/>
like Basic auth credentials.<br/>
<br/>
I suggest trying:<br/>
auth_param ntlm keep_alive off<br/>
<br/>
Squid-3 is now HTTP/1.1 which behaves a bit differently with persistent<br/>
connectiosn than HTTP/1.0 did. Which affects the pile of nasty hacks<br/>
needed to make NTLM work over HTTP.<br/>
<br/>
> Is this a problem in the browser?<br/>
<br/>
Yes, at least partially. The popup only occurs when the browser thinks<br/>
none of its credentials are valid to send to the proxy. Why it thinks<br/>
that might be a browser bug or a Squid bug. Or just the way NTLM behaves<br/>
in some HTTP message circumstances.<br/>
<br/>
> Is this a comunication problem with squind and Active Directory?<br/>
<br/>
Unlikely. It's more probably between Squid and browser. Squid only<br/>
interacts with AD at the start of a new TCP connection, or when NTLM is<br/>
started on an existing connection.<br/>
<br/>
It could be browser sending unacceptible credentials (eg. the users<br/>
machine's account instead of the users own account) then deciding NTLM<br/>
is unusable.<br/>
<br/>
It could be the browser failing to send the right NTLM token for Squid<br/>
to check against the existing known credentials tied to the connection.<br/>
<br/>
<br/>
> I would like to undestrand why, so i need advices to start debug and find a<br/>
> solution.<br/>
<br/>
<<a href="https://deref-mail.com/mail/client/c6_H0i188Ps/dereferrer/?redirectUrl=http%3A%2F%2Fwiki.squid-cache.org%2FKnowledgeBase%2FDebugSections" target="_blank">http://wiki.squid-cache.org/KnowledgeBase/DebugSections</a>><br/>
<br/>
Section 29 is the various authenticators. You will also need the ACL<br/>
processing section and results.<br/>
<br/>
Amos</div></div></body></html>