Safari proxy with AD credentials

[mellowip1983]

are there any keys in WGM to set the proxy username and password to the login credentials of the AD user?

 

Our LEA has just upgraded our filtering and now the mac users are being asked for authentication

[chill3r]

doesnt add to key chain work ???

 

does the Proxy have AD intergration ?

 

What proxy is it ???

[mellowip1983]

The proxy does have AD integration but safari doesn't have use authentication set.

 

Would like the students not to have to type anything due to their lack of ability.

 

The proxy is a custom made to Wirral LEA called Evolution Web Filter

[chill3r]

Click on the user and choose Preferences and then Network Put a tick in Proxie as always and then save and then click on details - look for com.apple.SystemConfiguration this has lots of Bits and bobs you can configure, but without the proxie being "Invisiable" "Cloacked" etc then im very dought full you can access the Proxy without Authorisation.

 

We use an Ident client in for the form of a Plist so we can track the users and machines filtering.

 

You would maybe have to look at something on the proxy for the Mac users ?

 

Are all your Machines Bound to AD?

[mellowip1983]

Yep all the ones that access the internet are AD Bound.

 

Will go take a look at this now.

[HodgeHi]

When we had a smoothwall box I used identd to allow authentication as the macs had quite a few difficulties in authenticating. Safari has changed quite a bit though since then (around 4 years ago).

[MicrodigitUK]

From 10.6.8 Safari has auto athentication in a AD golden triangle setup. If you use the FQDN in the proxy setings, Kerberos Proxy Authentication will work. The proxy needs to be referenced by the fully qualified domain name so the key chain knows what to use. So if your proxy setings just have IP or a short name like "proxy", it will fail. Try using "proxy.domain.internal" and it should authenticate with the loged on domain.internal user on the Mac.

[mellowip1983]

I shall ask the lea if there is a fqdn for the proxy, they have only ever issued us with an ip address. for now they have put the ip scope into a bypass so they aren't filtered at the moment but can access the internet.

[MicrodigitUK]

On your local AD DNS server just add a record to point to the LEA IP address. E.g a new A record of "proxy" would then have a FQDN of "proxy.domain.internal". Replace domain.internal with the full name of your domain. Job done...

[User3204]

I shall ask the lea if there is a fqdn for the proxy, they have only ever issued us with an ip address. for now they have put the ip scope into a bypass so they aren't filtered at the moment but can access the internet.

 

If they don't give you one, you can try 'ping -a 10.12.4.122', which should resolve properly, if you're using their DNS on 10.12.4.60.

 

I have local proxies on my network, both of which then forward on, the local ones are part of my AD, and then I use the IP to give the access level.

 

 

It was funny this morning when I got a couple of messages to say that facebook was now blocked...

[mellowip1983]

MicrodigitUK many thanks this worked. I applied it last night and have tested this morning, users were not being asked for credentials. Now to just sort out little issues with students being able to access facebook.

 

User 3204 which school are you in?

[osagendn]

I know this is an old post but has anyone else gotten this to work? We are running Mac OS X 10.8.3. I have my proxy set to proxy.domain.com. All of our Active Directory users have a username of [email protected]. However when we go to any webpages we keep getting the proxy authentication requirement. Is there anyway around it?

[mellowip1983]

we discussed this with out LEA as they provide our filtering & proxy.

 

We ended up putting out Mac's in to an address band at the top of our IP Scope, then applied a filter set to that scope. So no AD username filtering sorted on our site.

[MicrodigitUK]

I know this is an old post but has anyone else gotten this to work? We are running Mac OS X 10.8.3. I have my proxy set to proxy.domain.com. All of our Active Directory users have a username of [email protected]. However when we go to any webpages we keep getting the proxy authentication requirement. Is there anyway around it?

 

Your proxy must support and be set to use 'Kerberos Proxy Authentication' for this to work.

[cannonballcoops1987]

We are having a similar problem in our School. all our macs are integrated with AD. staff and students can log on but unfortunately both are experiencing the Proxy window come up and ask for authentication in either Safari or applications that need the internet - does happen to admins but not as much. probably has something to do with the fact that we are still running R610 servers using Exchange 2003 and ISA Server 2004 but just wanted to check if there was anything else that i might have missed...

 

Simon