Explicit Proxy with Kerberos auth not working

[ninoshev]

Hello good people!

Since few days i'm trying to configure Proxy on Fortigate 500E with FortiOS 6.0.3 and no luck so far.

I have straight forward configuration:

config authentication scheme edit "Kerberos" set method negotiate set negotiate-ntlm disable

config authentication rule edit "Kerberos" set srcaddr "all" set ip-based disable set active-auth-method "Kerberos" set web-auth-cookie enable next

user krb-keytab is with principal, ldap-server and keytab.

For proxy rule I have a source entire 192.168.0.0/16 network, corresponding AD group from the LDAP server and all services.

Once I test the connection, all browsers immediately pops up asking for user and pass and if I run diagnose debug application fnbamd -1 I don't see any LDAP query attempts nor into the logs I see any failed authentications. Once I check with Wireshark I see only NTLMSSP_NEGOTIATE packets flowing. I'm wondering what may be wrong here and how to troubleshoot it on the Fortigate like debug commands or log view to see why this is failing.

Any suggestions will be much appreciated. 

[judit]

Did you set the 'active-auth-scheme' in config auth setting?

config authentication setting set active-auth-scheme "Kerberos" end

[ninoshev]

Yes, it is set. Additionally, I have tested the keytab file and it is working.

[ninoshev]

I figured out why it is not working but still can't figure out how to fix it.

I have executed fnsysctl ls -la /tmp/kt and i don't see the keytab file imported. The configuration was done directly with admin account so I'm excluding a permissions issue. Also I tried to import a keytab file from already working Explicit Proxy Fortigate and again the keytab file is missing/not imported. From CLI I don't get any error once I'm pasting the encode with base64 string. Anyone had that issue before?

[KVB]

Hi ninoshev. Having the exact same symptoms as you are. I suppose your browser also gets the 407 request?

 Did you get any further with this issue ?