Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)
- by Dari
I am trying to enable proxy authentication via Kerberos for Firefox. The setup is:
Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets without problems)
Microsoft Windows witness machine (on which Firefox runs fine with no ticket problem)
CentOS 6.3 system with Firefox (the tests were performed with both the 10.0.1 ESR found in the CentOS package repositories and the 15.0.1 downloaded from Mozilla's website)
BlueCoat proxy with Kerberos authentication enabled
For the moment, Firefox requests an element of a website, gets an HTTP error code of "407 Proxy Authentication Required" from the proxy, gets a ticket granting service (TGS) from the domain for the proxy and performs the request again while passing the ticket. The transaction runs fine.
However, when more elements are requested (in parallel), Firefox requests one more ticket per proxy connection. And this takes many DNS queries, Kerberos interactions with domain controllers and costs a lot of time (for example, the home page of Adobe takes several minutes to load and at the end, I have about 30 valid Kerberos tickets).
I am stuck on this since a while, and help would be greatly appreciated.
Minor information: the CentOS operating system is virtualized with VMware Player 3.1.3, but I do not think this would be a game changer.
