The Proxy’s Hostname Is Part of a Kerberos Login

Automatic domain authentication to an HTTP proxy can use Negotiate and Kerberos. The client needs a ticket for the proxy service, not merely a remembered website password.

For a proxy advertised as proxy.example.net, a service principal can have this form:

HTTP/[email protected]

The hostname used by the client, the registered service principal and the proxy’s keytab must fit the deployment. Squid’s Kerberos configuration documents the HTTP service principal and the helper’s use of that key material.

Using an IP address or another alias can change ordinary service-name selection. Before changing user passwords, establish which proxy name the client actually used and which authentication mechanism completed or failed.

Negotiate is a negotiation mechanism. Windows can select Kerberos or fall back to NTLM under applicable conditions; seeing the word Negotiate does not prove that the Kerberos exchange succeeded.

Keep automatic credential use within the client and domain policy intended for this proxy. A normal browser session and a service running under another account can obtain different credentials and authorization outcomes.