{"action":"created","issue":{"url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/1363","repository_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external","labels_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/1363/labels{/name}","comments_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/1363/comments","events_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/1363/events","html_url":"https://github.com/ra-at-diladele-com/qlproxy_external/issues/1363","id":164718691,"number":1363,"title":"NTLM auth helper needs to support 2 DCs","user":{"login":"ra-at-diladele-com","id":2544598,"avatar_url":"https://avatars.githubusercontent.com/u/2544598?v=3","gravatar_id":"","url":"https://api.github.com/users/ra-at-diladele-com","html_url":"https://github.com/ra-at-diladele-com","followers_url":"https://api.github.com/users/ra-at-diladele-com/followers","following_url":"https://api.github.com/users/ra-at-diladele-com/following{/other_user}","gists_url":"https://api.github.com/users/ra-at-diladele-com/gists{/gist_id}","starred_url":"https://api.github.com/users/ra-at-diladele-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ra-at-diladele-com/subscriptions","organizations_url":"https://api.github.com/users/ra-at-diladele-com/orgs","repos_url":"https://api.github.com/users/ra-at-diladele-com/repos","events_url":"https://api.github.com/users/ra-at-diladele-com/events{/privacy}","received_events_url":"https://api.github.com/users/ra-at-diladele-com/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"ra-at-diladele-com","id":2544598,"avatar_url":"https://avatars.githubusercontent.com/u/2544598?v=3","gravatar_id":"","url":"https://api.github.com/users/ra-at-diladele-com","html_url":"https://github.com/ra-at-diladele-com","followers_url":"https://api.github.com/users/ra-at-diladele-com/followers","following_url":"https://api.github.com/users/ra-at-diladele-com/following{/other_user}","gists_url":"https://api.github.com/users/ra-at-diladele-com/gists{/gist_id}","starred_url":"https://api.github.com/users/ra-at-diladele-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ra-at-diladele-com/subscriptions","organizations_url":"https://api.github.com/users/ra-at-diladele-com/orgs","repos_url":"https://api.github.com/users/ra-at-diladele-com/repos","events_url":"https://api.github.com/users/ra-at-diladele-com/events{/privacy}","received_events_url":"https://api.github.com/users/ra-at-diladele-com/received_events","type":"User","site_admin":false},"assignees":[{"login":"ra-at-diladele-com","id":2544598,"avatar_url":"https://avatars.githubusercontent.com/u/2544598?v=3","gravatar_id":"","url":"https://api.github.com/users/ra-at-diladele-com","html_url":"https://github.com/ra-at-diladele-com","followers_url":"https://api.github.com/users/ra-at-diladele-com/followers","following_url":"https://api.github.com/users/ra-at-diladele-com/following{/other_user}","gists_url":"https://api.github.com/users/ra-at-diladele-com/gists{/gist_id}","starred_url":"https://api.github.com/users/ra-at-diladele-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ra-at-diladele-com/subscriptions","organizations_url":"https://api.github.com/users/ra-at-diladele-com/orgs","repos_url":"https://api.github.com/users/ra-at-diladele-com/repos","events_url":"https://api.github.com/users/ra-at-diladele-com/events{/privacy}","received_events_url":"https://api.github.com/users/ra-at-diladele-com/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/milestones/45","html_url":"https://github.com/ra-at-diladele-com/qlproxy_external/milestones/4.6%20Priority%201","labels_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/milestones/45/labels","id":1705565,"number":45,"title":"4.6 Priority 1","description":"* NTLM authenticator in AD\r\n* Send PDFs of generated reports by e-mail","creator":{"login":"ra-at-diladele-com","id":2544598,"avatar_url":"https://avatars.githubusercontent.com/u/2544598?v=3","gravatar_id":"","url":"https://api.github.com/users/ra-at-diladele-com","html_url":"https://github.com/ra-at-diladele-com","followers_url":"https://api.github.com/users/ra-at-diladele-com/followers","following_url":"https://api.github.com/users/ra-at-diladele-com/following{/other_user}","gists_url":"https://api.github.com/users/ra-at-diladele-com/gists{/gist_id}","starred_url":"https://api.github.com/users/ra-at-diladele-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ra-at-diladele-com/subscriptions","organizations_url":"https://api.github.com/users/ra-at-diladele-com/orgs","repos_url":"https://api.github.com/users/ra-at-diladele-com/repos","events_url":"https://api.github.com/users/ra-at-diladele-com/events{/privacy}","received_events_url":"https://api.github.com/users/ra-at-diladele-com/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2016-04-14T09:50:24Z","updated_at":"2016-09-11T15:42:02Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2016-07-10T14:45:08Z","updated_at":"2016-09-12T10:07:22Z","closed_at":null,"body":""},"comment":{"url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/comments/246304228","html_url":"https://github.com/ra-at-diladele-com/qlproxy_external/issues/1363#issuecomment-246304228","issue_url":"https://api.github.com/repos/ra-at-diladele-com/qlproxy_external/issues/1363","id":246304228,"user":{"login":"ra-at-diladele-com","id":2544598,"avatar_url":"https://avatars.githubusercontent.com/u/2544598?v=3","gravatar_id":"","url":"https://api.github.com/users/ra-at-diladele-com","html_url":"https://github.com/ra-at-diladele-com","followers_url":"https://api.github.com/users/ra-at-diladele-com/followers","following_url":"https://api.github.com/users/ra-at-diladele-com/following{/other_user}","gists_url":"https://api.github.com/users/ra-at-diladele-com/gists{/gist_id}","starred_url":"https://api.github.com/users/ra-at-diladele-com/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ra-at-diladele-com/subscriptions","organizations_url":"https://api.github.com/users/ra-at-diladele-com/orgs","repos_url":"https://api.github.com/users/ra-at-diladele-com/repos","events_url":"https://api.github.com/users/ra-at-diladele-com/events{/privacy}","received_events_url":"https://api.github.com/users/ra-at-diladele-com/received_events","type":"User","site_admin":false},"created_at":"2016-09-12T10:07:22Z","updated_at":"2016-09-12T10:07:22Z","body":"The problem with NTLM protocol is that it is stateful. Imaging what happens in this scenario:\r\n\r\n- browser initiates the connection\r\n- squid tell us - try to validate these NTLM credentials\r\n- we connect to LDAP server1 and handle the connection to it\r\n- ldap server responds to us\r\n- we send the intermediate auth token to squid\r\n- squid sends it to browser\r\n- browser responds to squid\r\n- squid gives us the token\r\n- LDAP SERVER GOES DOWN\r\n- we cannot connect to 1st server and to 2nd server - to first because it is down and to send because it does not know about state of the connection and of course rejects our authentication attempts.\r\n\r\nAs we do not have any load balancing logic in the NTLM helpers (as there are N helpers running at the same time which do NOT have shared state (and we do not want to introduce shared state to them)) - next time squid asks for the connection:\r\n\r\n- we try to connect to LDAP1 see that we cannot establish connection and\r\n- connect to LDAP2\r\n\r\nThis is the maximum level of 2 DC support that we can provide.\r\nI.e. \r\n\r\nNTLM authentication attempts initiated on the working LDAP server that crashed - will *ALWAYS* fail\r\nNTLM authentication attempts if first server is not working and second is working - will be first tried on the first server and after failure will be tried on the second server."}}
{"actor":{"display_login":"ra-at-diladele-com"}}