Skip to main content
ninoshev
ninoshev
New Member
May 13, 2019
Question

Explicit Proxy with Kerberos auth not working

  • May 13, 2019
  • 1 reply
  • 6652 views

Hello good people!

 

Since few days i'm trying to configure Proxy on Fortigate 500E with FortiOS 6.0.3 and no luck so far.

I have straight forward configuration:

 

config authentication scheme edit "Kerberos" set method negotiate set negotiate-ntlm disable

 

config authentication rule edit "Kerberos" set srcaddr "all" set ip-based disable set active-auth-method "Kerberos" set web-auth-cookie enable next

 

user krb-keytab is with principal, ldap-server and keytab.

 

For proxy rule I have a source entire 192.168.0.0/16 network, corresponding AD group from the LDAP server and all services.

 

Once I test the connection, all browsers immediately pops up asking for user and pass and if I run diagnose debug application fnbamd -1 I don't see any LDAP query attempts nor into the logs I see any failed authentications. Once I check with Wireshark I see only NTLMSSP_NEGOTIATE packets flowing. I'm wondering what may be wrong here and how to troubleshoot it on the Fortigate like debug commands or log view to see why this is failing.

 

Any suggestions will be much appreciated. 

1 reply

judit
judit
New Member
May 16, 2019

Did you set the 'active-auth-scheme' in config auth setting?

 

config authentication setting set active-auth-scheme "Kerberos" end

ninoshev
ninoshevAuthor
New Member
May 16, 2019

Yes, it is set. Additionally, I have tested the keytab file and it is working.

ninoshev
ninoshevAuthor
New Member
May 16, 2019

I figured out why it is not working but still can't figure out how to fix it.

 

I have executed fnsysctl ls -la /tmp/kt and i don't see the keytab file imported. The configuration was done directly with admin account so I'm excluding a permissions issue. Also I tried to import a keytab file from already working Explicit Proxy Fortigate and again the keytab file is missing/not imported. From CLI I don't get any error once I'm pasting the encode with base64 string. Anyone had that issue before?

Terms & ConditionsAccessibility statement