Bug 31972

Summary:	add gss-spnego (kerberos) support to squid_ldap_ntlm_auth
Product:	UCS	Reporter:	Felix Botner <botner>
Component:	Squid	Assignee:	Felix Botner <botner>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P5	CC:	gohmann, requate, schwardt
Version:	UCS 3.1	Keywords:	interim-1
Target Milestone:	UCS 3.2
Hardware:	Other
OS:	Linux
What kind of report is it?:	---	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:
Bug Depends on:	31967
Bug Blocks:	31905, 31995, 32029

Description Felix Botner

2013-07-15 13:13:23 CEST

The changes here should be merged to UCS 3.2

+++ This bug was initially created as a clone of Bug #31967 +++

We should gss-spnego (kerberos) support to squid_ldap_ntlm_auth

than we activate squid negotiate:

# auth negotiate
auth_param negotiate program /usr/lib/squid3/squid_ldap_ntlm_auth --debug --gss-spnego
auth_param negotiate children 10

Linux user with a keberos ticket than can authenticate to the squid server without a password prompt. Windows user with a ticket (samba4) also

Windows user without a ticket (samba3) can also authenticate without a password because then windows does ntlm over negotiate.

Comment 1 Felix Botner

2013-07-30 11:40:51 CEST

OK, 

QA, see Bug #31967

Comment 2 Felix Botner

2013-08-05 15:17:50 CEST

*** Bug 26296 has been marked as a duplicate of this bug. ***

Comment 3 Arvid Requate

2013-08-21 19:17:39 CEST

Verified:
* Continues to work after update to ucs3.2-0
* Changelog OK

Test was set up on a Samba4 DC with:

ucr set repository/online/unmaintained='yes'; ucr set squid/krb5auth=yes; univention-install univention-squid-kerberos; univention-run-join-scripts;

Comment 4 Stefan Gohmann

2013-11-19 06:43:25 CET

UCS 3.2 has been released:
 http://docs.univention.de/release-notes-3.2-en.html
 http://docs.univention.de/release-notes-3.2-de.html

If this error occurs again, please use "Clone This Bug".