[ipad] Keeps prompting for authentication for proxy

[localzuk]

We have recently set up an authenticated proxy here, and all devices are happy with it except Apple iPads.

 

Users put their username and password in the proxy settings and for the most part, that works fine. However, randomly, it keeps prompting for them to enter a username and password.

 

I've already got the following domains excluded from the need to authenticate:

 

.mzstatic.com

securemetrics.apple.com

.phobos.apple.com

.icloud.com

.itunes.apple.com

xp.apple.com

 

Are there more Apple/iTunes/iPad related addresses I should exclude?

[localzuk]

I've now added .apple.com as an exclusion - as there appear to be a pile of domains I'd missed but all of them are under apple.com.

 

Lets see if that fixes it.

[jinnantonnixx]

I use a combination of dstdomain and browser headers and combine them in an access URL.

 

(Squid 3.1)

 

 

acl iTunes_header browser iTunes oscpd QuickTime GCSL GCSP InetURL/1.0 AppleCoreMedia
acl iTunes_dst dstdomain .apple.com .gcsp.cddbp.net .icloud.com  ax.phobos.apple.com.edgesuite.net .mzstatic.com
....
....

http_access allow iTunes_header iTunes_dst

Edited June 18, 2013 by jinnantonnixx

[bshingler]

albert.apple.com

ax.phobos.apple.com

configuration.apple.com

securemetrics.apple.com

p06-fmip.icloud.com

ax.init.itunes.apple.com

gs.apple.com

keyvalueservice.icloud.com

appldnld.apple.com

setup.icloud.com

itunes.com

icloud.com

p09-mobilebackup.icloud.com

gsp1.apple.com

ax.itunes.apple.com

p09-quota.icloud.com

metrics.apple.com

courier.push.apple.com

itunes.apple.com

apple.com

 

have you setup a vlan for ipads on wireless and allow that vlan with no authentication but push it through a group like students.

 

we have 3vlans for wireless one with authentication for laptops / ipad for staff and ipads for students

[localzuk]

There isn't a VLAN for them yet - our wireless will be getting a redesign in summer where things will be split off.

 

Not sure what you mean 'allow that vlan with no authentication but push it through a group like students'. The iPads we have here are all individually assigned to staff at the moment, so they put their individual login details in. However, any devices which end up 'floating' will end up with a captive portal for logging in instead when it gets changed.

 

Its just these addresses I need to add to get it to ignore auth for the specific addresses.

 

Why can't Apple do things properly?!

[jinnantonnixx]

Its just these addresses I need to add to get it to ignore auth for the specific addresses.

 

Why can't Apple do things properly?!

 

That alc combo works for us for all our ipads and Macs.

 

It's not just Apple, lots of software assumes no proxy is present.

[bshingler]

you will find that some apps will not authenticate because they are not proxy aware..

 

to get round this - what are you using for filtering? we use smoothwall and have groups setup staff and students.

 

SSID - Staff - VLAN 101 - has no authentication required and its IP range maps to Staff filtering policy group

SSID - Students - VLAN - 102 - has no authentication required and its IP range maps to Student filtering policy group

SSID - Wireless - VLAN 103 - NTLM authentication for laptops etc

 

it all depends on what you can achieve with your filtering and authentication - if you use the standard captive portal alot of apps will not function as there is no captive portal available to the app

[localzuk]

We have SWGfL filtering - we can't adjust filtering to a granular level - ie. different levels for different groups.

 

If we shift to a captive portal for all ipads, this would resolve the issue wouldn't it? We can't have zero auth, as we can't then tell who went on what sites.

 

Captive portal works for all devices afaik - as you have the proxy as the gateway on the device, and users have to log in via a web browser first, and then all apps just get normal access.

[bshingler]

it depends on what you want to achieve and your network layout - if you set your gateway to the internet filter you obviously limit yourself on accessing network resources using webdav for home drives etc..

 

if you are assigning ipads 1:1 you get them to name the device properly and dhcp will pickup the device name - means you track the IP to the user.

i have not used SWGfL before so cannot confirm if the captive portal will work or not.. the issue arrises when the apps do not know how to redirect to username and password as some are not programmed to understand being behind a proxy. its a trial and error - once you whitelist those domains you have no tractability anyway

[localzuk]

it depends on what you want to achieve and your network layout - if you set your gateway to the internet filter you obviously limit yourself on accessing network resources using webdav for home drives etc..

 

We have no need for this - home drives are accessible via our VLE.

 

if you are assigning ipads 1:1 you get them to name the device properly and dhcp will pickup the device name - means you track the IP to the user.

i have not used SWGfL before so cannot confirm if the captive portal will work or not.. the issue arrises when the apps do not know how to redirect to username and password as some are not programmed to understand being behind a proxy. its a trial and error - once you whitelist those domains you have no tractability anyway

 

We're not assigning 1:1 - we have no need and no money to do so. iPads are used by a few teachers and the SEN dept here, that's it.

 

The captive portal would be on the wireless - not on our filtering. So, people would sign in to use the wireless, and the internet then routed via our onsite proxy.

[localzuk]

Seems that's going to be my plan then:

 

All iPads and Android devices will have their own VLAN. The VLAN will have a captive portal and it'll be a transparent proxy. Our wireless will log usernames against IPs, and our proxy will log IPs against sites.