Why is squid breaking kerberos/NTLM auth?
- by DonEstefan
I'm using squid 2.6.22 (Centos 5 Default) as a proxy. Squid seems to break the authentication process for web pages when they require NTLM or Kerberos Auth.
I tested with sharepoint 2007 and tried all 3 authentication methods (NTLM, Kerberos, Basic).
Accessing the site without squid works in all cases. When I access the same page with squid, then only basic-auth works.
Using IE or Firefox desn't make any difference. Squid itself can be used by anybody (no auth_param configured).
Its a bit tricky to find solutions online, since most of the topics whirl around auth_param for authenticating users to squid rather than authenticating users to a webpage behind squid.
Could anyone help?
Edit:
Sorry, but my first test was totally screwed up. I tested against the wrong webservers (Memo to myself: always check assumptions before testing). Now I realized that the problem scenario is completely different.
Kerberos work for IE
Kerberos works for Firefox (after changing "network.negotiate-auth.trusted-uris" in about:config)
NTLM works for IE
NTLM does NOT work in Firefox (even after changing "network.automatic-ntlm-auth.trusted-uris" in about:config)
By the way:
The feature that provides NTLM-passthrough in squid is called "connection pinning" and the HTTP header "Proxy-support: Session-based-authentication""