[squid-users] Negotiate on 3.2.1

Hi!

I'm following the guide here
http://wiki.squid-cache.org/ConfigExamples/Authenticate/WindowsActiveDirectory
...to get Negotiate authentication working with Squid 3.2.1. NTLM
works fine but I when using Negotiate I am getting this in my
cache.log...

2012/08/17 17:31:01 kid1| ERROR: Negotiate Authentication validating
user. Error returned 'BH gss_accept_sec_context() failed: Unspecified
GSS failure. Minor code may provide more information. '

"kinit -V -kt /etc/squid/HTTP.keytab HTTP/proxy01.domain.local" produces...

Using default cache: /tmp/krb5cc_0
Using principal: HTTP/proxy01.domain.local_at_DOMAIN.LOCAL
Using keytab: /etc/squid/HTTP.keytab
kinit: Preauthentication failed while getting initial credentials

"klist -ekt /etc/squid/HTTP.keytab" produces...

Keytab name: WRFILE:/etc/squid/HTTP.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
   2 08/17/12 17:18:03 proxy01-h$@DOMAIN.LOCAL (arcfour-hmac)
   2 08/17/12 17:18:04 proxy01-h$@DOMAIN.LOCAL (aes128-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 proxy01-h$@DOMAIN.LOCAL (aes256-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 HTTP/proxy01.domain.local_at_DOMAIN.LOCAL (arcfour-hmac)
   2 08/17/12 17:18:04 HTTP/proxy01.domain.local_at_DOMAIN.LOCAL
(aes128-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 HTTP/proxy01.domain.local_at_DOMAIN.LOCAL
(aes256-cts-hmac-sha1-96)
   3 08/17/12 17:18:57 proxy01-h$@DOMAIN.LOCAL (arcfour-hmac)
   3 08/17/12 17:18:57 proxy01-h$@DOMAIN.LOCAL (aes128-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 host/proxy01.domain.local_at_DOMAIN.LOCAL (arcfour-hmac)
   3 08/17/12 17:18:57 proxy01-h$@DOMAIN.LOCAL (aes256-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 host/proxy01.domain.local_at_DOMAIN.LOCAL
(aes128-cts-hmac-sha1-96)
   2 08/17/12 17:18:04 host/proxy01.domain.local_at_DOMAIN.LOCAL
(aes256-cts-hmac-sha1-96)

auth_params are...

auth_param negotiate program /usr/lib/squid/negotiate_kerb_auth
auth_param negotiate children 30 startup=10 idle=5
auth_param negotiate keep_alive on

Can anyone help? I'm guessing I've not done something rather important?

Thank you.

Paul
Received on Fri Aug 17 2012 - 17:13:37 MDT