Sunand, Can you verify this?

Scoles, Is your proxy server address rubble.wellpakuk.com?

 Issue 7688  has been merged into this issue.

 Issue 6666  has been merged into this issue.

Darin, I could not find a duplicate for this and we had a number of users report it.  

Although this issue mentions proxy and ISA, this issue is really
a duplicate of  issue 6824 .  I'll leave this issue open so that
it's easier for other people having problem with proxy authentication
to find it.

 Issue 6193  has been merged into this issue.

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=9964 

------------------------------------------------------------------------
r9964 | wtc@chromium.org | 2009-02-18 13:00:32 -0800 (Wed, 18 Feb 2009) | 6 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction.cc?r1=9964&r2=9963
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction.h?r1=9964&r2=9963
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction_unittest.cc?r1=9964&r2=9963

Perform HTTP authentication over a keep-alive connection.
This is required for NTLM authentication.

R=eroman
BUG=6567,6824
Review URL: http://codereview.chromium.org/21433
------------------------------------------------------------------------

(No comment was entered for this change.)

this bug is a regression, but also firefox and IE don't ask me for a proxy password
they just use my login details automatically for the proxy authentication.

ok IE is microsoft so its a given, but firefox is opensource and if firefox can do it
so can chrome (just look at how firefox does it)

a lot of people use ISA server in business and for me to have to type in my
authentication details everytime its annoying.  I want to use chrome at work but this
is a barrier to using it in a business

Thank you for your comment.  Chromium's not using your login
details automatically for proxy authentication is issue 19.

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=10324 

------------------------------------------------------------------------
r10324 | wtc@chromium.org | 2009-02-24 18:53:01 -0800 (Tue, 24 Feb 2009) | 11 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/app/generated_resources.grd?r1=10324&r2=10323
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/login_prompt.cc?r1=10324&r2=10323

Add a new message id IDS_LOGIN_DIALOG_DESCRIPTION_NO_REALM,
which is a variant of IDS_LOGIN_DIALOG_DESCRIPTION that
doesn't have a realm.  Some HTTP authentication schemes
such as NTLM don't have a realm.

In IDS_LOGIN_DIALOG_DESCRIPTION, changed the placeholder's
name from "TITLE" to "REALM".

R=eroman,tony
BUG=6567,6824
Review URL: http://codereview.chromium.org/27117
------------------------------------------------------------------------

Comment 11  by wtc@chromium.org, Feb 18 (6 days ago)

Thank you for your comment.  Chromium's not using your login
details automatically for proxy authentication is issue 19.

--------------

SO WHY HASN'T IT BEEN DONE THEN.  ITS ISSUE 19 THIS IS 6567.  HOW COME THIS ISSUE HAS
BEEN FIX BUT 19 HASN'T

spoke too soon just updated to 2.0.164.0 and i get this when i try and surf to
www.google.co.uk

HTTP 407 Proxy Authentication Required - The ISA Server requires authorization to
fulfill the request. Access to the Web Proxy service is denied. (12209)
Internet Security and Acceleration Server

so it hasn't been fixed

> SO WHY HASN'T IT BEEN DONE THEN.  ITS ISSUE 19 THIS IS 6567.  HOW COME
> THIS ISSUE HAS BEEN FIX BUT 19 HASN'T

We work on issues in order of priority, not in the order they are reported.  This 
issue has Priority 1 and is targeted for Milestone 2.0.  Issue 19 has Priority 2 and 
is not targeted at a specific milestone.  Once we have fixed all the Priority 1 
issues, we can move on to fixing Priority 2 issues.

doesn't work for me with 2.0.166.1, despite release notes

Technical Information (for support personnel)
Error Code: 407 Proxy Authentication Required. The ISA Server requires authorization
to fulfill the request. Access to the Web Proxy filter is denied. (12209)
IP Address: 192.168.xxx.yyy
Date: 26/02/2009 7.45.38 [GMT]
Server: XXXXXXXXXXXXXXXXXX
Source: proxy

Sorry about the confusion.  The release notes by default list all
the new checkins, so the 2.0.166.1 release notes list an intermediate
checkin for this bug.  In the future I'll try to remove mentions of
intermediate checkins for this bug from release notes to avoid confusion.

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=10667 

------------------------------------------------------------------------
r10667 | wtc@chromium.org | 2009-02-27 17:29:24 -0800 (Fri, 27 Feb 2009) | 6 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/build/net.vcproj?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/build/net_unittests.vcproj?r1=10667&r2=10666
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/des.cc
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/des.h
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/des_unittest.cc
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth.h?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_cache_unittest.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler.h?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_basic.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_digest.cc?r1=10667&r2=10666
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.cc
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.h
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_unittest.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction.cc?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction_unittest.cc?r1=10667&r2=10666
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/md4.cc
   A http://src.chromium.org/viewvc/chrome/trunk/src/net/http/md4.h
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/net.xcodeproj/project.pbxproj?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/net_lib.scons?r1=10667&r2=10666
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/net_unittests.scons?r1=10667&r2=10666

Implement the NTLM authentication scheme by porting
Mozilla's implementation.

R=darin,eroman
BUG=6567,6824
Review URL: http://codereview.chromium.org/28144
------------------------------------------------------------------------

I checked in our NTLM authentication code in r10667.  I have
only tested it with the IIS web server, so I still need to
test it with a proxy server.

I don't have ISA.  I plan to set up a Squid proxy with NTLM
authentication on Monday.  I'd appreciate it if someone could
test the latest Chromium nightly build (build 10675 or later )from
http://build.chromium.org/buildbot/snapshots/chromium-rel-xp/
with ISA.  Please note in your report wether you're using a
"domain" account or a local account.  Thanks a lot for your
help.

@wtc@chromium.org

I can confirm build 10689 works with ISA 2006 using a domain account.

Domain account, ISA server cluster (no idea what version), just tried build 10689 
from the URL mentioned in comment 19: Chrome does popup a dialog box asking me for my 
username and password for our proxy (it autodetected the URL and port). After 
entering the username/password I could access sites behind the proxy.

So success on actually being able to authenticate (this does not work for any 2.x 
released Chrome version for me) but I assume that NTLM implies that popping up a 
dialog box is redundant.

With domain account works for me as well exactly as in comment 21.

My domain account authentication works with both IIS and our company proxy server.  

But it fails if I turn on Privoxy.  I looked at the traffic with Wireshark and it 
seems the full NTLM cycle isn't completed.  I can't say whether it's a Chromium or 
Privoxy problem though

have tested 10675 and latest 10689 again isa 2000 proxy server (my proxy is
rubble[server net bios name] and port number 8080)

when i try to browse to a web page i get asked for a username and password (my domain
credentials) once entered web pages work

however i'm guessing the NTLM authentication doesn't work quite right cos it still
asks me for a username password and firefox doesn't

as i got a isa 2000 proxy setup, i would be happy to run some debug scripts to get to
the bottom of this and paste\upload the result i'm sure others would be willing to do
the same.  maybe as the comment says about a wireshark of chrome but also a wireshark
of firefox so you can see the difference between the 2 on different machines

I had the same problem reported on this issue. With nightly build 10689 i can access 
internet. I'm behind a ISA 2006 server and using a domain account on my pc. Box 
asking for authentication appears, as it appeared in all google chrome 1.x versions, 
which doesn't bother me much, as I can quickly change user just to access the 
internet.

Thanks to all who tested the latest nightly build and posted their
test reports.

Re: the need to enter username/password (domain credentials) for
NTLM authentication: the lack of automatic logon for NTLM auth is
a known issue of Chromium (issue 19).  The stable channel release
of Google Chrome 1.0.154.x has the same issue.  This bug is only
concerned with the regression that NTLM did not work at all.

Re: igitur's comment 23: I'll try to find out more about Privoxy.
I'd appreciate it if you could test a stable channel release of
Google Chrome (version 1.0.154.x) and Firefox 3.0.x against Privoxy.
Since we copied Firefox's NTLM code, our behavior should be the
same as Firefox with these preference settings:
- network.automatic-ntlm-auth.allow-proxies: false
- network.automatic-ntlm-auth.trusted-uris: (empty string)
- network.ntlm.send-lm-response: false
You can examine and set these Firefox preferences by typing
"about:config" into Firefox's location bar and then typing "ntlm"
into the Filter field.

I've been using Chrome + Privoxy since the pre v1 release, and even on the current dev build 
(2.0.166.1) Privoxy works fine.  So think this patch caused a regression of some sort.

To clarify, I use Privoxy on my office PC which forwards requests the company proxy, which in turn 
requires NTLM authentication.  Privoxy itself isn't explicitly configured to require any sort of 
authentication.

I'll try the Fx stuff tomorrow. I haven't used Fx with Privoxy because Adblock Plus has always been 
sufficient.

it's fixed but as comment 18 says you have ported the ntlm authentication to chrome 
so you might as well get it to auto authenticate reading your config stuff do i just
need to set:
network.automatic-ntlm-auth.allow-proxies:true

i.e look up the ntlm settings in firefox and set the same in chrome

does chrome share setttings with firefox.
how do you set preference settings in chrome?

Dude, if you want to keep on ranting about the auto-authentication, do it at issue 
19.  This is not the place.

Firefox 3.1b2 + Privoxy works without problems:  On browsing to www.ibm.com, I get a 
dialog request my username and password. I enter them and browsing occurs as 
expected.

igitur: thanks for the additional info on Privoxy.  I opened  issue 8325  for the 
Privoxy problem.

Re: comment 28: Chromium does not share settings with Firefox.  To set preference 
settings in Chromium, click the "wrench" icon (at the upper right corner) and select 
the "Options" menu item.  We don't have the preference settings equivalent to the 
Firefox settings I listed in comment 26 yet.  That will be fixed as part of issue 19.

igitur: please see  issue 8325  comment 2 for a test build that
could help diagnose the Privoxy problem.  Please post your findings
in that issue.

Using v2.0.166.1 I receive a cache access denied error. Chrome never prompts me to 
enter authentication credentials for the proxy server. 

Using Build 11045 I am prompted for the authentication settings. http sites work. 
https sites fail to load, with Error 115 (net::ERR_PROXY_AUTH_REQUESTED): Unknown 
error.

Proxy = Squid server 2.7, client OS = XP

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=11488 

------------------------------------------------------------------------
r11488 | wtc@chromium.org | 2009-03-11 15:21:29 -0700 (Wed, 11 Mar 2009) | 8 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.cc?r1=11488&r2=11487
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.h?r1=11488&r2=11487
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction_unittest.cc?r1=11488&r2=11487

Add unit tests for NTLM authentication.  This requires
overriding the functions that generate random bytes or get
the local host name, so that the generated NTLM messages are
reproducible.

R=eroman
BUG=6567,6824
Review URL: http://codereview.chromium.org/42052
------------------------------------------------------------------------

Re: comment 33: aaronfraser, thanks for the bug report regarding
Squid.  I filed  issue 8771  for that bug.  Please follow up there.
I have a question for you in  issue 8771  and will ask you to test
a new build with logging turned on to collect some information.

I'm debugging the Squid problem reported by aaronfraser and I haven't
been able to set up NTLM auth with my test Squid proxy.

Has anyone successfully performed NTLM auth to a Squid proxy using a
Dev channel release (2.0.x.x)?

I have a regression to report: as I noted in comment 21 NTLM authentication through
an ISA proxy cluster worked for build 10689, it currently doesn't work anymore with
release 2.0.170.0.

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=12290 

------------------------------------------------------------------------
r12290 | wtc@chromium.org | 2009-03-23 09:52:20 -0700 (Mon, 23 Mar 2009) | 17 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.cc?r1=12290&r2=12289
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_auth_handler_ntlm.h?r1=12290&r2=12289
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction_unittest.cc?r1=12290&r2=12289

Make GetHostNameProc return a std::string.

Add the ScopedProcSetter helper class so that unit tests
restore the original GenerateRandom and GetHostName
functions on completion.

Merge NTLMAuthModule into HttpAuthHandlerNTLM.  The data
members domain_, username_, and password_ are moved.  The
Init method is inlined at its only call site.  The
GetNextToken method is moved.

Make generate_random_proc_ and get_host_name_proc_ static
members of the HttpAuthHandlerNTLM class.

R=eroman
BUG=6567,6824
Review URL: http://codereview.chromium.org/43113
------------------------------------------------------------------------

Re: comment 37

aggregat4: thanks for the bug report.  Could you describe the
symptoms?  What does the error page say?  Could you try a
HTTP and a HTTPS URL?

Do you have time to do a binary search for the first build in
which the regression started to appear?

http://build.chromium.org/buildbot/snapshots/chromium-rel-xp/

The interval in which you need to search is between:

Known good build: 10689 (see comment 21)
Known bad build: 11755 (2.0.170.0)

If not, I will add some error log messages based on your
description of the symptoms to collect some more info.

I just tried again with 10689 and it doesn't work with that either anymore. Firefox
still works fine. I have the feeling our IT department is messing around with the
proxy here at work. I will try to figure out the current state of affairs and report
back when I have info. When I can, I am willing to do the bisecting to find the
failing build.

aggregat4: Thanks for the report.  Here is the relevant info of
our support of NTLM authentication.

1. We only support the "NTLM" authentication scheme.  We don't
support the "Negotiate" authentication scheme.

2. We only support NTLMv1.  We don't support NTLMv2.

 Issue 7801  has been merged into this issue.

(No comment was entered for this change.)