[squid-users] kerberos auth failing behind a load balancer

Hi,

I’ve received (kemp) load balancers to put in front of squids to
provide failover.
The failover / balancing works fine until I enable Kerberos auth on the squid.

Test setup:
Browser ==> Kemp balancer ==> Squid ==> Internet
                         proxy.example.com proxy3.example.com

 The client in Windows7 in an Active Directory domain.
If the browser proxy is set to proxy3.example.com (bypassing the LB),
Kerberos auth works just fine, but via the kemp (proxy.example.com)
the browser prompts for a username/password which is not accepted
anyway

Googling on Squid+LBs, the key is apparently to add a principal for the LB, e.g.
net ads keytab add HTTP/proxy.example.com

In the logs (below), one can see the client sending back a Krb ticket
to squid, but it rejects it:
"negotiate_wrapper: Return 'BH gss_accept_sec_context() failed:
Unspecified GSS failure. "
When I searched on that. one user suggested changing the encryption in
/etc/krb5.conf . In /etc/krb5.conf I tried with the recommended
squid settings (see below), and also with none at all. The results
were the same. Anyway, if encryption was the issue, it would not work,
via LB or directly.

Analysis:
-------------
When the client sent a request, squid replies with:

HTTP/1.1 407 Proxy Authentication Required
Server: squid
X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
X-Cache: MISS from gsiproxy3.vptt.ch
Via: 1.1 gsiproxy3.vptt.ch (squid)

ok so far. the client answer with a kerberos ticket:

Proxy-Authorization: Negotiate YIIWpgYGKwYBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

UserRequest.cc(338) authenticate: header Negotiate
YIIWpgYGKwYBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
UserRequest.cc(360) authenticate: No connection authentication type
Config.cc(52) CreateAuthUser: header = 'Negotiate YIIWpgYGKwYBBQUCXXXX
auth_negotiate.cc(303) decode: decode Negotiate authentication
UserRequest.cc(93) valid: Validated. Auth::UserRequest '0x20d68d0'.
UserRequest.cc(51) authenticated: user not fully authenticated.
UserRequest.cc(198) authenticate: auth state negotiate none. Received
blob: 'Negotiate
YIIWpgYGKwYBBQUCoIIWmjCCFpagMDAuBgkqhkiC9xIBAXXXXXXXXXX
..
UserRequest.cc(101) module_start: credentials state is '2'
helper.cc(1407) helperStatefulDispatch: helperStatefulDispatch:
Request sent to negotiateauthenticator #1, 7740 bytes
negotiate_wrapper: Got 'YR YIIWpgYGKwYBBQXXXXXXXXXXXXXXX
negotiate_wrapper: received Kerberos token
negotiate_wrapper: Return 'BH gss_accept_sec_context() failed:
Unspecified GSS failure. Minor code may provide more information.

Logs for a (successful) auth without LB:
     .. as above ....
     negotiate_wrapper: received Kerberos token
     negotiate_wrapper: Return 'AF oYGXXXXXXXXXXXXXXXXXXXXXXA== USER_at_EXAMPLE.NET

----- configuration ---
Ubuntu 12.04 + std kerberod. Squid 3.2 bzr head from lat Jan.
- squid.conf:
- debug_options ALL,2 29,9 (to catch auth)
auth_param negotiate program
/usr/local/squid/libexec/negotiate_wrapper_auth -d --kerberos
/usr/local/squid/libexec/negotiate_kerberos_auth -s GSS_C_NO_NAME
--ntlm /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param negotiate children 20 startup=20 idle=20 auth_param
negotiate keep_alive on

- The LB is configured as a Generic Proxy (does not try to interpret
the HTTP stream), with with Layer 7 transparency
  (it forwards traffic to the squid, the squid see the real client IP,
and squid traffic is routed back though the LB)
   I've tried playing with the LB Layer 7 settings, to no avail.

Samba:
net ads join -U USER
net ads testjoin
  Join is OK

net ads keytab add HTTP -U USER
net ads keytab add HTTP/proxy.example.com -U USER
chgrp proxy /etc/krb5.keytab
chmod 640 /etc/krb5.keytab
strings /etc/krb5.keytab # check contents
net ads keytab list

/etc/krb5.conf
 [libdefaults]
    default_realm = EXAMPLE.NET
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true
    fcc-mit-ticketflags = true
    default_keytab_name = FILE:/etc/krb5.keytab
    dns_lookup_realm = no
    ticket_lifetime = 24h

[realms]
    EXAMPLE.net = {
        kdc = ldap.EXAMPLE.net
        master_kdc = ldap.EXAMPLE.net
        admin_server = ldap.EXAMPLE.net
        default_domain = EXAMPLE.net
    }
[domain_realm]
    .corproot.net = EXAMPLE.NET
    corproot.net = EXAMPLE.NET

Any suggestions on where I could dig further?

Thanks in advance,

Sean Boran
Received on Thu Feb 28 2013 - 12:57:37 MST