14

I'm using macOS Sierra 10.12.6 behind a corporate NTLM proxy. My browser and other applications are using the system proxy settings, in which I have saved my username and password for authenticating with the proxy. This is working fine.

There is a persistent problem with system services that try to access information on the internet and don't see to have access to the proxy credentials in my user account. I see the following popup every couple of minutes, and whatever I do (updating my credentials in System Preferences, or pressing "Not Now"), the popup keeps coming up again and again:

Proxy Authentication Required

The text in the popup reads:

Proxy Authentication Required

Enter the password for the HTTP proxy http://xxx.xxx.xxx.xxx:yyyy in System Preferences.

What can I do to stop this popup from appearing?

Things I have tried so far:

  • Updated my credentials in System Preferences (Network > Advanced > Proxy)
  • Copied the credentials entries from my login keychain to the System keychain, since I read a recommendation for that in a blog post or forum question.

None of these has worked, I get this popup every couple of minutes, and there does not seem to be a pattern to when it shows up.

Update 1:

As soon as I enter my credentials by clicking the System Preferences button in the above dialog (which I can force by e.g. opening Safari and starting to type a URL in the location box), two records are created in the login keychain, both with identical content:

@ xxx.xxx.xxx.xxx (username) Internet Password Today, 09:10 -- login

Both records look identical, with the same name and attributes. Both show that the application that requested this is AuthBrokerAgent:

Keychain Access Control

Update 2:

I've also tried this suggestion: https://discussions.apple.com/message/23848961#message23848961, copying the authentication entries from the login keychain to the system keychain and then rebooting, but it did not fix it. In fact, the dreaded "Proxy Authentication Required" box showed up again while typing this...

Update 3:

I've used Wireshark to take a look at the traffic between my machine and our proxy:

  • The proxy returns with a 407 Proxy Authentication Required and Proxy-Authenticate: NTLM, which is in line with my expectation, since our proxy uses NTLM.
  • Some examples I've seen in the traffic (e.g. iCloud) then send back an NTLMSSP_NEGOTIATE response.
  • The proxy comes back with an NTLMSSP_CHALLENGE request
  • The service responds with NTLMSSP_AUTH and my username, which it must have gotten from somewhere.
  • The proxy finally responds with a 200 Connection established

To me, this shows that in general the proxy authentication works fine, if the system can get the username and proxy from somewhere. The question remains how/where to store the username/password so that all system services can find it. Some system services (I assume) don't have any means to find the proxy credentials where I'm currently storing them.

  • Related question: apple.stackexchange.com/questions/117556/… – nwinkler Jul 24 '17 at 10:58
  • What proxy are you using? I remember (from a different past life) that a proxy we were using had the ability to disallow storing of passwords thereby forcing the user to authenticate each and every time. This could be the case. – Allan Aug 14 '17 at 15:11
  • 1
    Did you ever resolve this issue because I encounter the same problem occasionally and I'm connecting to a Citrix VPN solution. Once the pop-up appears it just happens over and over again and eventually my AD account will lock up. I have yet to find a solution that resolves this. Since I'm using a MacBook Pro and the majority of the IT Department is Windows based I have been unable to receive any useful information from IT. Once I do connect to the VPN I'm working on Oracle applications running on Solaris SPARC servers. I really hope you find a way to resolve this issue. stan – Stan Repetta Feb 23 at 20:05
  • Sorry, have not found a solution for this yet. What I end up doing is that I move the window that asks for the proxy credentials to the side of the screen without pressing any of the buttons - that keeps it quiet at least... – nwinkler Feb 24 at 8:46
9
+100

This is most likely expected behavior if your system/network administrator has configured the proxy force authentication that requires more than just a basic authentication scheme.

From Microsoft's page Handling Authentication under About HTTP Authentication section:

There are two general types of authentication schemes:

  • Basic authentication scheme, where the user name and password are sent in cleartext to the server.
  • Challenge-response schemes, which allow for a challenge-response format.

Challenge-response schemes enable more secure authentication. If a request requires authentication using a challenge-response scheme, the appropriate status code and Authenticate headers are returned to the client. The client must then to resend the request with a negotiate. The server would return an appropriate status code with a challenge, and the client would then require to resend the request with the proper response to get the requested service.

If the proxy you are using utilizes the basic authentication scheme, what's saved in your keychain will suffice to authenticate you. If a challenge response scheme is being used, you will most likely have to provide more info - in this case - re-enter your password - to authenticate; and this is what you are seeing.

NTLM Authentication Process

This is much more than just storing credentials. The client must generate a response based upon a generated request from the server. Following is a very abridged description of the authentication process from the client/server perspective per Microsoft's documentation

  • The client sends the user name to the server (in plaintext).
  • The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
  • The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the response.
  • The server sends the following three items to the domain controller:

    • User name
    • Challenge sent to the client
    • Response received from the client
  • The DC validates the encrypted challenge and response. If authenticated, access is granted.

The third step above, requires the client to hash a random number it got from the server. This inherently means there's nothing to be stored on your macOS client.

At a very minimum, you need to be joined the Active Directory domain. This means you need Kerberos support enabled and configured properly for your specific organization.

There's a key phrase in the "Handling Authentication" document I linked above:

If authentication is required, the INTERNET_FLAG_KEEP_CONNECTION flag should be used in the call to HttpOpenRequest. The INTERNET_FLAG_KEEP_CONNECTION flag is required for NTLM and other types of authentication in order to maintain the connection while completing the authentication process. If the connection is not maintained, the authentication process must be restarted with the proxy or server.

(Emphasis mine)

Based on your the symptoms being presented it appears that your organization requires authentication to the proxy; your username/password are valid, but it keeps (re)asking for authentication. It's probably because you are losing the connection state and having to do this all over again. Which further emphasizes the point....

To solve this issue, you will need to contact your network admin to assist you with the authentication issues.

  • 1
    How can I find out which authentication scheme is being used? Is there an HTTP header that I could look at when an application is talking to the proxy? Can I do this in Chrome's network console, or do I have to use something like Wireshark? – nwinkler Aug 15 '17 at 7:09
  • More than likely, you would need to use Wireshark. Keep in mind, it may also be encrypted traffic. – Allan Aug 15 '17 at 10:57
  • 1
    I've added some info from what I've seen in Wireshark to the question. – nwinkler Aug 15 '17 at 11:01
  • 1
    Thanks for adding more info on NTLM to your answer. I understand NTLM, and from what I can see from the Wireshark output, it is working - the challenge/response you describe is being done, e.g. for Dropbox or iCloud services. I'm still not sure which service is popping up the repeated proxy credential dialogs. Your answer contains a lot of info, but does not really help me so far. – nwinkler Aug 16 '17 at 6:42
  • 1
    Connection Established != Access Granted. The people who can confirm that this is working is your system/network admin(s) in your IT department. – Allan Aug 16 '17 at 10:39
1

Note: check radio button to allow all application to use proxy

by authention of key chain app modify setting

-2

Run the following command from Console.app:

networksetup -setwebproxy "Your Interface Name" "web proxy hostname or IP" 
8080 on username password

You will be asked about keychain access. Agree to add the record into keychain and you will have an access without the password all the time when your keychain is open.

  • 1
    I've tried this, but it does not fix the issue. The command sets the proxy config for my user, and stores the authentication in my user's login keychain. Right after I did this, the proxy authentication dialog I show above popped up again. Your suggested fix does not fix the issue for me. – nwinkler Aug 14 '17 at 14:53
  • because your login keychain is locked or you have double records – Siarhei Karatkevich Aug 14 '17 at 15:54
  • 1
    The login keychain is unlocked, I double-checked that. The point about double records might be valid, though. I deleted all records for the proxy authentication that I found in the login and system keychains, but as soon as I type in my password once in the dialog in my original post, I end up with two records in the login keychain, both with exactly the same data. If I delete one, it comes back when I enter my credentials again. – nwinkler Aug 15 '17 at 7:07
  • 1
    I tried the security command you listed - it does not find anything. It does if I change the find-generic-password command to find-internet-password, since the Keychain lists the entry as of kind "Internet password". – nwinkler Aug 15 '17 at 9:32
  • 1
    The proxy URL is set up as xxx.xxx.xxx.xxx, that's the way it's been working e.g. from command line. I'll try to capture something using Wireshark. – nwinkler Aug 15 '17 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .