Bug 31972 - add gss-spnego (kerberos) support to squid_ldap_ntlm_auth
add gss-spnego (kerberos) support to squid_ldap_ntlm_auth
Product: UCS
Classification: Unclassified
Component: Squid
UCS 3.1
Other Linux
: P5 normal (vote)
: UCS 3.2
Assigned To: Felix Botner
Arvid Requate
: interim-1
: 26296 (view as bug list)
Depends on: 31967
Blocks: 31905 31995 32029
  Show dependency treegraph
Reported: 2013-07-15 13:13 CEST by Felix Botner
Modified: 2014-01-08 11:11 CET (History)
3 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Note You need to log in before you can comment on or make changes to this bug.
Description Felix Botner univentionstaff 2013-07-15 13:13:23 CEST
The changes here should be merged to UCS 3.2

+++ This bug was initially created as a clone of Bug #31967 +++

We should gss-spnego (kerberos) support to squid_ldap_ntlm_auth

than we activate squid negotiate:

# auth negotiate
auth_param negotiate program /usr/lib/squid3/squid_ldap_ntlm_auth --debug --gss-spnego
auth_param negotiate children 10

Linux user with a keberos ticket than can authenticate to the squid server without a password prompt. Windows user with a ticket (samba4) also

Windows user without a ticket (samba3) can also authenticate without a password because then windows does ntlm over negotiate.
Comment 1 Felix Botner univentionstaff 2013-07-30 11:40:51 CEST

QA, see Bug #31967
Comment 2 Felix Botner univentionstaff 2013-08-05 15:17:50 CEST
*** Bug 26296 has been marked as a duplicate of this bug. ***
Comment 3 Arvid Requate univentionstaff 2013-08-21 19:17:39 CEST
* Continues to work after update to ucs3.2-0
* Changelog OK

Test was set up on a Samba4 DC with:

ucr set repository/online/unmaintained='yes'; ucr set squid/krb5auth=yes; univention-install univention-squid-kerberos; univention-run-join-scripts;
Comment 4 Stefan Gohmann univentionstaff 2013-11-19 06:43:25 CET
UCS 3.2 has been released:

If this error occurs again, please use "Clone This Bug".