Perform NTLM authentication when Kerberos authentication is not possible.

Background

In certain contexts, it may be necessary to enable Kerberos/NTLM authentication failover. This is because some applications that do not know how to respond to a Kerberos challenge may not be able to access the internet if no other method is offered to them.

Procedure

1. Select Kerberos authentication inAdvanced Proxy>HTTP>Configuration>Authentication.

2. Add the following lines for NTLM inAdvanced Proxy>HTTP>Configuration>Advanced Configuration>Before Authentication

auth_param ntlm program /usr/bin/ntlm_auth –helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 100 on-persistent-overload=ERR
auth_param ntlm keep_alive off

Thus, an application that cannot respond to a Kerberos challenge will have the option of switching to NTLM. For example, the browser will display an authentication window to allow users of non-domain workstations to authenticate themselves.

Which gives:

An update may comment out its lines, so we recommend that you check this menu after each update and uncomment them if necessary.

 

Proxy behavior without NTLM failover:

The authentication mode offered is "Negotiate" (Kerberos); there is no other alternative.

Proxy behavior with NTLM failover:

This time, the proxy offers "Negotiate" (Kerberos) and NTLM.

Articles related to Kerberos and NTLM authentication are available in the documentation:

NTLM authenticationhere
Kerberos authenticationhere