<html><body><div>echo "KK TlRMTVNTUAADAAAAGAAYAIwA....." | ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain=DOM1<br></div><div>NA NT_STATUS_INVALID_PARAMETER</div><div><br></div><div>---------------------------------------<br></div><div>squid.conf snippet:</div><div>...<br></div><div>## Authentication of NTLM:</div>auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=DOM1<br>auth_param ntlm children 100 startup=10<br><div>auth_param ntlm keep_alive off</div><div>external_acl_type ad_group ttl=600 children-max=200 %LOGIN /usr/lib/squid/ext_wbinfo_group_acl</div><div>...</div><div>##No other auth scheme.</div><div>----------------------------------------------<br></div><div>## /var/lib/samba:</div><div>drwxr-x--- 2 root winbindd_priv 4096 Jul 23 15:30 winbindd_privileged<br><br></div><div><br></div><div>Zbynek<br></div><div><br></div><div><br></div><br><aside>
---------- Původní e-mail ----------<br>
Od: Amos Jeffries <squid3@treenet.co.nz><br>
Komu: squid-users@lists.squid-cache.org<br>
Datum: 23. 7. 2019 11:03:37<br>
Předmět: Re: [squid-users] squid 4 fails to authenticate using NTLM
</aside><br><blockquote data-email="squid3@treenet.co.nz">On 23/07/19 7:53 am, zby wrote:<br>> My problem: my browser keeps on prompting for authentication.<br>> Facts:<br>> <br>> Debian 10 x86_64<br>> squid-4.6 + samba-4.9<br>> joined AD using "net ads join -U ...". OK.<br>> wbinfo -t : OK<br>> wbinfo -P or -p : OK<br>> wbinfo -i userXYZ : returns data (OK)<br>> wbinfo -g (well, fails to "deliver", too many users?)<br>> smbclient -U userXYZ //host/share : works, logs me in<br><br>This is irrelevant to Squid. It only tells that the user account has<br>filesystem access privileges. Nothing about web access privileges, or<br>whether the *Squid* user account has access to authenticate user logins.<br><br><br>> <br>> wbinfo -a domain\\user%pass:<br>> plaintext password authentication succeeded<br><br> "plaintext" means Basic authentication.<br><br>> challenge/response password authentication failed<br>> <br><br>Challenge/Response could mean anything auth related.<br><br><br>> sqadmin@host13:~$ ntlm_auth --helper-protocol=squid-2.5-ntlmssp<br>> --domain=ad001<br>> userw01 Passwd001<br>> SPNEGO request [userw01 Passwd001] invalid prefix<br>> BH SPNEGO request invalid prefix<br>> <br><br>"userw01 Passwd001" is not a SPNEGO token.<br><br>see<br><https://wiki.squid-cache.org/Features/AddonHelpers#Negotiate_and_NTLM_Scheme><br><br>Pass the helper the "KK" request command and the token you see in the<br>HTTP headers. For example:<br><br>KK TlRMTVNTUAADAAAAGAAYAIwAAABOAU4BpAAAAAoACgBYAAAAEAAQAGIAAAAa...<br><br><br><br>Amos<br>_______________________________________________<br>squid-users mailing list<br>squid-users@lists.squid-cache.org<br>http://lists.squid-cache.org/listinfo/squid-users<br></blockquote></body></html>