[PATCH] Strip Windows domain in PAM basic authenticator

From: Steve Hill <steve_at_opendium.com>
Date: Tue, 05 Mar 2013 18:17:41 +0000

This might be slightly controversial... :)

When accessing Squid from a Windows machine that is not logged onto a
domain, Internet Explorer presents the user with a proxy authentication
dialogue box for NTLM authentication, which requires the user name to be
entered as DOMAIN\user. Other software may instead choose to use basic
auth (handled by the basic_pam_auth authenticator) and pops up a similar
authentication box which requires the bare user name (no "DOMAIN\").

It is often not clear to the user that there is a difference between
these popup boxes, so they may not know whether or not to include the
windows domain. The attached patch modifies basic_pam_auth so that the
user can enter their user name as a bare name, "DOMAIN\user" or
"user_at_domain" and strips the domain part off so that the bare user name
can be authenticated against PAM.

This should simplify things for the users, since they can just be told
to enter their details in the "DOMAIN\user" format everywhere and it
should just work. Obviously not much use in a multi-domain setup, but
presumably one wouldn't be authenticating against PAM in such a
situation anyway (?).

-- 
  - Steve Hill
    Technical Director
    Opendium Limited     http://www.opendium.com
Direct contacts:
    Instant messager: xmpp:steve_at_opendium.com
    Email:            steve_at_opendium.com
    Phone:            sip:steve_at_opendium.com
Sales / enquiries contacts:
    Email:            sales_at_opendium.com
    Phone:            +44-844-9791439 / sip:sales_at_opendium.com
Support contacts:
    Email:            support_at_opendium.com
    Phone:            +44-844-4844916 / sip:support_at_opendium.com

Received on Tue Mar 05 2013 - 18:17:49 MST

This archive was generated by hypermail 2.2.0 : Wed Mar 06 2013 - 12:00:05 MST