Technical Tip: How to debug Kerberos authentication in FortiProxy

[KC_Hing]

Description	This article describes a working WAD debug flow for Kerberos authentication as an authentication method.
Scope	FortiProxy.
Solution	In this scenario, the FortiProxy has enforced to challenge the client browser with Kerberos as an authentication method. Kerberos Authentication Flow: The following command can be used to capture and save the WAD debug outputs: diagnose wad filter src <IP address> diagnose wad debug enable category auth diagnose wad debug enable category policy diagnose wad debug enable level verbose diagnose debug application fnbamd -1 diagnose debug enable To stop debug: diagnose debug disable diagnose debug reset Example of debugging outputs. The client browser sends an HTTP/1.1 connect method request toward the destination URL. The connection request was interrupted by FortiProxy to challenge an HTTP/1.1 407 proxy authentication required with negotiate (Kerberos) authentication as a preferred method. The client browser responds to a connect method request with a Kerberos service ticket (TGT) provided. FortiProxy will decipher the client Kerberos service ticket (TGT) with configured keytab to extract the user name used for LDAP query. FortiProxy to perform a proper lookup against the LDAP server for user and group membership matching. Authentication result showed success, the Fortiproxy allowed destination website access with an HTTP/1.1 200 OK. Related documents: Technical Tip: FortiGate explicit proxy authentication with Kerberos Technical Tip: Configure FortiProxy for multidomain Kerberos authentication