[squid-users] Re: Windows Authentication Helper client

"Matt Richards" <matt_at_mattstone.net> wrote in message
news:4BAC89A7.3050200_at_mattstone.net...
> Hello,
>
> Does anybody know if any technique or application that will allow
> windows machines (XP and 7) to authenticate against a proxy when
> applications don't support proxy authentication.
>
> What I am looking for is an alternative to Novell's Client Trust, its an
> application that sits in the system tray and when a user attempts to use
> the proxy the proxy will connect back to the IP address of the
> requesting machine on a specific port and talk to the client trust
> application to establish what user is logged on to the machine.
>
> At the moment we have a number of authentication mechanisms setup,
> including Kerberos, NTLM, basic and a web based login form if the
> machine is not a member of our domain or logged into a guest account.
> This all works well most of the time but there are a few cases where the
> software just fails to work when it tries to connect and pointing the
> machine (IE or the software) at a proxy that doesn't require
> authentication work without issue.
>
> It also works if the machine is logged in as our guest user and the user
> authenticates to the web form as this doesn't require the software to
> authenticate as the proxy knows to map that IP address to the
> authenticated user.
>
> I have looked through the internet and thought about this for a while
> now and I still haven't really been able to come up with anything that
> doesn't involve writing our own application for the workstation and an
> authentication helper for squid. My programming skills are basic.
>
> There was one thought I had which was to write scripts to add an entry
> in a database (memcache) after a request for a page from a successful
> login and then check this database in one of the steps in attempting to
> identify the user. I would probably use storeurl_rewrite_program to
> update the database. Only issues with this is working out what I would
> set the timeout to (users bounce around machines here quite a lot), if
> this would slow down the proxy too much (~120 requests per second for
> each proxy), and if the application is an exam application (downloads
> content, no network usage for 40 mins while they answer questions, then
> uploads the results) so it times out before the upload and also for this
> to work they will have to request content and successfully
> authentication before they will have a cache entry.
>
> Sorry for the long email, if anybody has any ideas I would really like
> to hear about them.
>
> Cheers,
>
> Matt.
>
>
>

Maybe the following could help
http://squidkerbauth.cvs.sourceforge.net/viewvc/squidkerbauth/squid_kerberizer/

Markus
Received on Sat Mar 27 2010 - 00:10:03 MDT