<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 11.00.10570.1001"></HEAD>
<BODY style="FONT-SIZE: 14px; FONT-FAMILY: Arial">
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2>i suggest you try: </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2>auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth
\<BR> --kerberos /usr/lib/squid/negotiate_kerberos_auth -s
<FONT color=#000000>s GSS_C_NO_NAME </FONT>\<BR> --ntlm
/usr/bin/ntlm_auth --helper-protocol=gss-spnego
--domain=MYDOMAIN<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2>Greetz, </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2>Louis</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=169110110-17012019><FONT color=#0000ff
size=2> </DIV></FONT></SPAN><FONT color=#0000ff size=2></FONT><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px"
dir=ltr>
<DIV lang=nl class=OutlookMessageHeader dir=ltr align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>Van:</B> squid-users
[mailto:squid-users-bounces@lists.squid-cache.org] <B>Namens </B>Silvester
Langen<BR><B>Verzonden:</B> donderdag 17 januari 2019 10:52<BR><B>Aan:</B>
squid-users@lists.squid-cache.org<BR><B>Onderwerp:</B> [squid-users] proxy
ntlm-auth problems<BR></FONT><BR></DIV>
<DIV></DIV>
<P>Hello squid users.</P>
<DIV> </DIV>
<DIV>I have configured squid for ntlm authentication and it seems to work
well. All needed browsers (ff, ie, chrome) work and programs like teamviewer
or "heise register" do work too. But now I notice, that other programs like
Sage HR, Dakota, Sfirm and Elster have problems with authentication.</DIV>
<DIV> </DIV>
<DIV>With wireshark I see the following:</DIV>
<DIV> </DIV>
<DIV>(Stage1) Browsers, Teamviewer, etc starting request to squid and squid
returns "407 Proxy Authentication Required". </DIV>
<DIV>(Stage2) After that the client begins a new request for negotiation and
sends the credentials. The connection works.</DIV>
<DIV> </DIV>
<DIV>But...</DIV>
<DIV> </DIV>
<DIV>(Stage1) Sage HR, Sfirm, etc. starts request to squid and squid returns
"407 Proxy Authentication Required". </DIV>
<DIV>After that the client begins a new request but the same without
credentials and negotiation. Of course, the proxy refuses the connection
again.</DIV>
<DIV> </DIV>
<DIV>I have no idea why the client software doesn´t start stage2 and no idea
to find out why.</DIV>
<DIV><FONT color=#0000ff size=2></FONT> </DIV>
<DIV>Here is my configuration for ntlm-auth:</DIV>
<DIV> </DIV>
<DIV>auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth -d
--ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp
--domain=mydomain --kerberos /usr/lib/squid3/squid_kerb_auth -d -s
GSS_C_NO_NAME</DIV>
<DIV>auth_param negotiate children 10</DIV>
<DIV>auth_param negotiate keep_alive off</DIV>
<DIV>acl auth proxy_auth REQUIRED</DIV>
<DIV>http_access allow auth</DIV>
<DIV> </DIV>
<DIV>Thank you for helping me!#<BR><BR>Silvester</DIV>
<DIV>
<H4 style="LINE-HEIGHT: 1"><B><SPAN
style="FONT-SIZE: x-small; FONT-FAMILY: Verdana; COLOR: #7b7e7d">Silvester
Langen</SPAN></B><BR><SPAN
style="FONT-SIZE: x-small; FONT-FAMILY: Verdana; COLOR: #7b7e7d">Fachinformatiker
- Systemintegration<BR>Auf dem Leuchtenberg 78</SPAN><BR><BR><SPAN
style="FONT-SIZE: x-small; FONT-FAMILY: Verdana; COLOR: #7b7e7d">41517
Grevenbroich</SPAN></H4>
<P><SPAN style="WIDTH: 4em; DISPLAY: inline-block">Mobil:</SPAN> 0170 69 66
580<BR><SPAN style="WIDTH: 4em; DISPLAY: inline-block">Tel:</SPAN> 02181 21
555 01<BR><SPAN style="WIDTH: 4em; DISPLAY: inline-block">Web:</SPAN> <A
title=FollowYourEyes href="https://silvesterlangen.de" target=_blank><SPAN
style="COLOR: rgb(255,102,0)">silvesterlangen.de</SPAN></A></P>
<P>Zertifizierter MCSA, MCSE, LPIC-1</P></DIV></BLOCKQUOTE></BODY></HTML>