Re: [squid-users] Re: squid_kerb_auth - Negotiate

On Wed, 11 Jul 2007 21:55:56 +0100
"Markus Moeller" <huaraz@moeller.plus.com> wrote:

> The return code 102 of parseNegTokenInit usually means the token is
> not a SPNEGO token. Could you sned me the complete token ?

Sure, here it is (full debug output (level 9) can also be sent if
needed)

2007/07/11 17:00:22| squid_kerb_auth: Got 'YR YIICTAYGKwYBBQUCoIICQDCCAjygMDAuBgk
qhkiC9xIBAgIGCSqGSIb3EgECAgYKKoZIhvcSAQICAwYKKwYBBAGCNwICCqKCAgYEggICYIIB/gYJKoZI
hvcSAQICAQBuggHtMIIB6aADAgEFoQMCAQ6iBwMFACAAAACjggEhYYIBHTCCARmgAwIBBaEUGxJTVFVER
U5USS5QT0xJVE8uSVSiIjAgoAMCAQKhGTAXGwRIVFRQGw9zcXVpZC5wb2xpdG8uaXSjgdcwgdSgAwIBEK
EDAgEDooHHBIHEWyFsulqOVPaP44POoDEBOs1Gz02LEdTBrYYGsJTDp4RGOUuEwY+GHPaJSSx/HtNNq76
XwssFV6tmiqsJw3MVwZ5EyakJwyYVjEbSuB9qmoOCOGFUmdiaogv9mQayHyOZXJA+54wmYmXn19RpOx7g
WpCYtoxZ9MBtanCWMSWp6glY0jVpi/hHdPzTD8uGQ2asR/kcqHxdPTslL1pH5uC+Bunk6C9ukVj9/Oe9e
dQRFsBHwHw14aaKQKmPQnH4liYcqFjRvqSBrjCBq6ADAgEBooGjBIGgX7XTlG0dTRI7Uz42jvA47p09tu
5Yh7zu/BuNKLILo4WcC1JGThjBQQZyL5cKWqmLIsI4+hUpeUdvIuU8J642Hnv2xZ3rcMloSWWeflan682
8a8ONLUq9sUnUgxWMOrFpDEkmL7bUhGB7kniaOCAH552mp86gHHOeYHb/QU7c9rSFHb4HcnGYw9QuUSlE
n0Xd9w52gYAqz7x7qwAeEi0+Zg==' from squid (length: 795).
2007/07/11 17:00:22| squid_kerb_auth: parseNegTokenInit failed with rc=102
2007/07/11 17:00:22| squid_kerb_auth: gss_accept_sec_context() failed: A token was invalid. Mechanism is incorrect

It was sent by a Firefox 2.0.0.4 on a Win2000 Computer.

>
> Which Kerberos release are you using ?

Debian Etch current one.
krb5 (1.4.4-7etch2)

Uoah, that's old!, didn't notice before.
Do you think kerberos 1.5.* or even 1.6.* will work better? (aka should
i upgrade kerberos to make things works?)

Tomorrow i think i'll do some other tests with ie7 and maybe i'll try with a different kerberos version.

Regards

--
Miolinux