Dansguardian Authentication

[Blue_Cookeh]

Hey guys,

 

Got Dansguardian/Squid authenticating to AD just fine but now I've got a problem with MS Office asking for domain credentials every time it's started now, putting in the correct credentials don't do anything, it just keeps prompting for them for every internet site it connects to. Anyone know how I can stop this? We're running Office 2013 and I don't really want to turn off Internet access for it in the Office settings...

 

Perhaps it's something to do with DG/Squid? I'm not too sure. We're using Endian Firewall.

 

Thanks

[Iain]

Office 2013 only uses Kerberos auth, and not NTLM. You'll need to setup Dansguardian and Squid to use this instead.

[Duke5A]

Hey guys,

 

Got Dansguardian/Squid authenticating to AD just fine but now I've got a problem with MS Office asking for domain credentials every time it's started now, putting in the correct credentials don't do anything, it just keeps prompting for them for every internet site it connects to. Anyone know how I can stop this? We're running Office 2013 and I don't really want to turn off Internet access for it in the Office settings...

 

Perhaps it's something to do with DG/Squid? I'm not too sure. We're using Endian Firewall.

 

Thanks

 

As Iain said Office only talks Kerberos now. Setting it up though can be a pain in the neck, so if you're just looking for a quick fix you can these domains to an ACL that doesn't require authentication.

 

.microsoft.com
.msecnd.net
.windowsupdate.com

 

I did this a while back until I had time to build new Squid proxies around Kerberos.

[safcphil]

As Iain said Office only talks Kerberos now. Setting it up though can be a pain in the neck, so if you're just looking for a quick fix you can these domains to an ACL that doesn't require authentication.

 

.microsoft.com
.msecnd.net
.windowsupdate.com

 

I did this a while back until I had time to build new Squid proxies around Kerberos.

 

this hasnt worked for me. any other ideas? doesnt seem to be any consistency in it asking for credentials but its very annoying.

[Duke5A]

Office 2013 might be calling out to different domains then. Just monitor your Squid access log while you recreate the issue on a test machine and whitelist the domains that are getting blocked.

 

tail -f /var/log/squid3/access.log | grep 

[Guest monkeyx]

Just to confirm we got this working via acls for on the squid.conf by adding the 2 sites below

 

.microsoft.com

.msecnd.net

[safcphil]

This seems to have improved situation but it still comes up occasionally. Thanks.