Firefox + Kerberos autentifikacia voci ISA proxy serveru vo Windows domene

Ahojte,

chceme rozchodit nasledovne: autentifikacia Firefoxa voci proxy serveru
(ISA 2004 od Microsoftu) cez Kerberos z Active Directory (AD). Na PC je
nainstalovany Linux od Novellu (SLED 11.1), pouzivatel je z daneho PC
prihlaseny do Windows domeny. /etc/krb5.conf z daneho PC je tu: http://dl.dropbox.com/u/1428952/krb5.conf,
namiesto XXXXXX.SK <http://xxxxxx.sk/> je realna domena.

Kerberos ticket dostanem cez PAM z domain controllera pri prihlaseni do
systemu. S tym problem nie je, funguje to napr. pri pripajani zdielanych
Samba foldrov, vystup klist je:

Desktop # klist
Ticket cache: FILE:/tmp/krb5cc_10001
Default principal: 999999 at XXXXXX.SK

Valid starting Expires Service principal
12/30/10 15:26:02 12/31/10 01:26:02 krbtgt/XXXXXX.SK <http://xxxxxx.sk/>@
XXXXXX.SK <http://xxxxxx.sk/>
renew until 01/06/11 15:26:02
12/30/10 15:26:02 12/31/10 01:26:02 Desktop$@XXXXXX.SK <http://xxxxxx.sk/>
renew until 01/06/11 15:26:02
12/30/10 16:34:58 12/31/10 01:26:02 sambaserver$@XXXXXX.SK<http://xxxxxx.sk/>
renew until 01/06/11 15:26:02

Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

*Avsak problem je s Firefoxom, ktory pouziva Negotiate Authentication
(Kerberos GSSAPI). Namiesto autentifikacie voci ISA 2004 proxy serveru
sa v logu browsera objavuje toto:*

-1220663600[b71551c0]: nsHttpChannel::ProcessAuthentication
[this=af411090 code=407]
-1220663600[b71551c0]: nsHttpChannel::PrepareForAuthentication
[this=af411090]
-1220663600[b71551c0]: nsHttpChannel::GetAuthenticator [this=af411090]
-1220663600[b71551c0]: nsHttpChannel::GetCredentialsForChallenge
[this=af411090 proxyAuth=1 challenges=Negotiate]
-1220663600[b71551c0]: nsHttpAuthCache::GetAuthEntryForDomain
[key=http://isa2004.xxxxxx.sk:8080 realm=]
-1220663600[b71551c0]: service = isa2004.xxxxxx.sk
-1220663600[b71551c0]: using negotiate-gss
-1220663600[b71551c0]: entering nsAuthGSSAPI::nsAuthGSSAPI()
-1220663600[b71551c0]: Attempting to load user specified library
[libgssapi_krb5.so.2]
-1220663600[b71551c0]: Attempting to load gss functions
-1220663600[b71551c0]: entering nsAuthGSSAPI::Init()
-1220663600[b71551c0]: identity invalid = 0
-1220663600[b71551c0]: nsHttpNegotiateAuth::GenerateCredentials_1_9_2()
[challenge=Negotiate]
-1220663600[b71551c0]: entering nsAuthGSSAPI::GetNextToken()
-1220663600[b71551c0]: gss_init_sec_context() failed: Unspecified GSS
failure. Minor code may provide more information
Server not found in Kerberos database

Nasleduje fallback na NTLM, my ale chceme Kerberos ;).

Skusal som okrem googlenia napriklad toto:
- zadanie active directory a proxy servera do /etc/hosts na danom PC
- nainstalovanie krb5-devel
- vytvorenie reverzneho DNS zaznamu pre IP adresu ISA servera
- rozne modifikacie krb5.conf
- modifikacie konfiguracnych parametrov negotiate-auth vo Firefoxe
(about:config)
- medzitym rozne restarty browsera ci celeho PC
- tcpdumpovanie komunikacie

Da niekto skuseny dalsie hinty co vyskusat a na co si posvietit?
Pripadne niekto komu to funguje?

Vopred dakujem.

Jano Ostrochovsky