[squid-users] GET requests remain in pending state with Squid and Kerberos auth

[Ahmad, Sarfaraz]

Hi,

I am using Squid as an explicit proxy (configured in the browsers) and have configured it to authenticate all users with Kerberos.
Here are the relevant bits from squid.conf

auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -r -s HTTP/proxytest1.mydomain.com at MYDOMAIN.COM -k /etc/squid/HTTP.keytab
auth_param negotiate children 10
auth_param negotiate keep_alive on

I know I should be expecting 407s for new TCP connections and pages do load a bit slower compared to Basic Auth.
But that isn't the problem. The problem is at times some of the web pages resources (GET requests mostly) just hang there endlessly. (Chrome just says pending)
When I do a refresh, the browser loads that very same resource(say a .js/.css file) just fine.

This is just a test setup and I looked at the negotiate helper stats. Here
   ID #          FD         PID     # Requests          # Replies            # Timed-out       Flags        Time   Offset  Request
      1            13        99482          551                       551                          0                    0.014         0       (none)
      2            17        99485           74          74           0                    0.016         0       (none)
      3            21      106324                           4             4             0                    0.025         0       (none)

I don't think they are the problem.
Any thoughts on what could be going on here? I don't have a way to reproduce this reliably so far and this happens intermittently.

Regards,
Sarfaraz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20180523/3b0bf7b6/attachment-0001.html>