[squid-users] Kerberos authentication with MIT KDC

I've looked through some of the mailing list archives and can't find anything specific on kerberos authentication to a MIT KDC for windows clients. Everything I've found mentions AD. What I'd like, if possible, is to have single sign on capabilities to between OS X server's Open Directory, squid 2.7stable9 on CentOS 5.5, and Windows XP clients. With pGina and kerberos for windows installed on the XP clients, I successfully get a ticket from the OD server. What I'm having problems with is getting firefox or IE to use the ticket for negotiation with the squid server. I'm guessing that I've missed setting up a principal correctly, copied keytab, or possibly a DNS issue but I'm not familiar enough with kerberos to know what's wrong. Packet captures for kerberos return KRB-ERROR like this after the TGS_REQ when opening a browser session with FF:

Kerberos KRB-ERROR
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    ctime: 2010-12-03 21:05:34 (UTC)
    stime: 2010-12-03 21:05:26 (UTC)
    susec: 714271
    error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7)
    Client Realm: XSERVE.PARAGOULD.PSD
    Client Name (Principal): HTTP/proxyserver.paragould.psd
        Name-type: Principal (1)
        Name: HTTP
        Name: proxyserver.paragould.psd
    Realm: XSERVE.PARAGOULD.PSD
    Server Name (Unknown): krbtgt/xserve.paragould.psd
        Name-type: Unknown (0)
        Name: krbtgt
        Name: xserve.paragould.psd
    e-text: UNKNOWN_SERVER

If anyone has any ideas or what to look for, I'd appreciate any help. If this isn't enough information from the capture to make an educated guess as to where I need to look further, I have the entire sequence I could post as well.

Thanks,
Rob

----------------
Rob Asher
Network Systems Technician
Paragould School District
870-236-7744 x169

----------

This message has been scanned for viruses and
dangerous content by the Paragould School District
MailScanner, and is believed to be clean.
Received on Mon Dec 06 2010 - 20:53:38 MST