<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
Hi all<br>
<br>
i have setup Kerberos authentication with Windows 2019 domain using
Squid 5.1 ( The Squid version did not fix the issue - Tested 4.x and
5.x)<br>
In some cases, some computers are not joined to the domain and ween
need to allow authenticate on Squid<br>
<br>
To allow this, Basic Authentication is defined in Squid and we
expect that browsers prompt a login to be authenticated and access
to Internet<br>
<br>
But the behavior is strange.<br>
<br>
On a computer outside the windows domain:<br>
Firefox is be able to be successfully authenticated to squid using
basic auth.<br>
Edge, Chrome and IE still try ujsing NTLM method and are allways
rejected with a 407<br>
<br>
When edge, chrome and IE try to establish a session, Squid claim <br>
<br>
2021/09/21 01:17:27 kid1| ERROR: Negotiate Authentication validating
user. Result: {result=BH, notes={message: received type 1 NTLM
token; }}<br>
<br>
This let us understanding that these 3 browsers try NTLM instead of
a Basic Authentication.<br>
<br>
I did not know why these browsers using NTLM as they did not
connected to the Windows domain <br>
Why squid never get the Basic Authentication credentials. ?<br>
<br>
Did i miss something ?<br>
<br>
Here it is my configuration.<br>
<br>
auth_param negotiate program /lib/squid3/negotiate_kerberos_auth -r
-s GSS_C_NO_NAME -k /etc/squid3/PROXY.keytab<br>
auth_param negotiate children 20 startup=5 idle=1 concurrency=0
queue-size=80 on-persistent-overload=ERR<br>
auth_param negotiate keep_alive on<br>
<br>
auth_param basic program /lib/squid3/basic_ldap_auth -v -R -b
"DC=articatech,DC=int" -D <a class="moz-txt-link-rfc2396E" href="mailto:administrator@articatech.int">"administrator@articatech.int"</a> -W
/etc/squid3/ldappass.txt -f sAMAccountName=%s -v 3 -h 192.168.90.10<br>
auth_param basic children 3<br>
auth_param basic realm Active Directory articatech.int<br>
auth_param basic credentialsttl 7200 seconds<br>
authenticate_ttl 3600 seconds<br>
authenticate_ip_ttl 1 seconds<br>
authenticate_cache_garbage_interval 3600 seconds<br>
<br>
acl AUTHENTICATED proxy_auth REQUIRED<br>
<br>
</body>
</html>