squid kerberos

2013/02/09 20:50:55| squid_kerb_auth: parseNegTokenInit failed with rc=102
2013/02/09 20:50:55| squid_kerb_auth: gss_acquire_cred() failed: Unspecified GSS failure.  Minor code may provide more information. Key table entry not found

auth_param negotiate program /usr/lib/squid/squid_kerb_auth -d -s HTTP/squid.domain.loc@DOMAIN.LOC
auth_param negotiate children 100
auth_param negotiate keep_alive on

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = DOMAIN.LOC
 dns_lookup_realm = no
 dns_lookup_kdc = no
 kdc_timesync = 1
 ticket_lifetime = 24h
 forwardable = true
 proxiable = true
 default_keytab_name = /etc/squid/squid.keytab
 default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
 default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
 permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
[realms]
 DOMAIN.LOC = {
  kdc = wk8r2.domain.loc
  admin_server = wk8r2.domain.loc
  default_domain = domain.loc
 }
[domain_realm]
.domain.loc = DOMAIN.LOC
domain.loc = DOMAIN.LOC

# squid -v
Squid Cache: Version 2.7.STABLE7
configure options:  '--prefix=/usr' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--sbindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--sysconfdir=/etc/squid' '--localstatedir=/var/spool/squid' '--datadir=/usr/share/squid' '--enable-async-io' '--with-pthreads' '--enable-storeio=ufs,aufs,coss,diskd,null' '--enable-linux-netfilter' '--enable-arp-acl' '--enable-epoll' '--enable-removal-policies=lru,heap' '--enable-snmp' '--enable-delay-pools' '--enable-htcp' '--enable-cache-digests' '--enable-underscores' '--enable-referer-log' '--enable-useragent-log' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-carp' '--enable-follow-x-forwarded-for' '--with-large-files' '--with-maxfd=65536' 'amd64-debian-linux' 'build_alias=amd64-debian-linux' 'host_alias=amd64-debian-linux' 'target_alias=amd64-debian-linux' 'CFLAGS=-Wall -g -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='

# su -l proxy -c "kinit -V -k -t /etc/squid/squid.keytab HTTP/proxy.domain.loc"
Authenticated to Kerberos v5

# su -l proxy -c "klist"
Ticket cache: FILE:/tmp/krb5cc_13
Default principal: HTTP/proxy.domain.loc@DOMAIN.LOC

Valid starting     Expires            Service principal
02/09/13 21:06:12  02/10/13 07:06:12  krbtgt/DOMAIN.LOC@DOMAIN.LOC
	renew until 02/10/13 07:06:12

# echo $KRB5_KTNAME
/etc/squid/squid.keytab