ITunes using anonymous authentication through proxy

Hi All,
We have a bit of an issue here at work, we are trying to update our iPads to the latest version of IOS and they get as far as verifying the update with the apple servers and then we get a 3004 error.
Looking into this further, it seems that what is happening is that iTunes is using anonymous authentication with our proxy server (Microsoft ISA) as looking at the logs from ISA reveals it denies the connection due to anonymous authentication being used.
Is there a way that I can make iTunes use my windows credentials when authenticating or are there any other ways around this?

Fixed by not using a proxy. If you have a proxy, then you can't update your iPod through iTunes - and, because that is the only way you can do it now, you are stuck!

Similar Messages

SPAM on Exchange when using "anonymous" authentication on frontend connector

Hi all,
I have Exchange 2013 SP1 installation with all roles on one box. My initial configuration worked fine, I was able to send and receive emails just fine. Yesterday however, I noticed that emails were not flowing anymore and when I checked the Queue viewer,
I saw thousands of SPAM emails being sent - most of them sent to yahoo.com.tw domain. I managed to clean the Queue and I unchecked the anonymous authentication on the default frontend connector and the SPAM stopped but we cannot receive emails anymore (sender
gets 530 5.7.1 Client was not authenticated message).
As soon as I enable anonymous, SPAM starts again. I don't have an external relay, I am sending email directly from Exchange. Can you guys offer any advice as to how to go about this? How do I enable send/receive emails without getting all this SPAM?
DB

So, I managed to get a hang of it, we are in the process of acquiring a third party anti-spam solution, but in the meantime, I stopped spammers using my server by using the built in Exchange AntiSpam agents. I followed the suggestions in this article:
http://www.allspammedup.com/2013/11/exchange-2013-anti-spam-technologies-the-sender-filter-agent/
and set the sender filter agent to block certain addresses and, more importantly, to block empty sender messages. It is all fine for now, but I will keep monitoring it.
DB

Cannot use SASL Authentication Through GSSAPI on DS 6.3

I try to kerberized DS 6.3. I do step by step instruction from "Sun Java System Directory Server Enterprise Edition 6.3" and it doesn't work.
When I try to configure the Directory Server to Enable GSSAPI I get an error:
modifying entry cn=SASL,cn=security,cn=config
ldap_modify: DSA is unwilling to perform
ldap_modify: additional info: Modification not allowed on attribute dsSaslPluginsPath
After all when I try to authenticate to the Directory Server i get response:
ldap_sasl_interactive_bind_s: Authentication method not supported
ldap_sasl_interactive_bind_s: additional info: sasl mechanism not supported
Logs file:
+[22/Sep/2008:10:28:11 +0200] conn=2 op=-1 msgId=-1 - fd=22 slot=22 LDAP connection from 10.3.233.4:33054 to 10.3.233.4+
+[22/Sep/2008:10:28:11 +0200] conn=2 op=0 msgId=1 - BIND dn="" method=sasl version=3 mech=GSSAPI+
+[22/Sep/2008:10:28:11 +0200] conn=2 op=0 msgId=1 - RESULT err=7 tag=97 nentries=0 etime=0, sasl mechanism not supported+
+[22/Sep/2008:10:28:11 +0200] conn=2 op=1 msgId=2 - UNBIND+
+[22/Sep/2008:10:28:11 +0200] conn=2 op=1 msgId=-1 - closing from 10.3.233.4:33054 - U1 - Connection closed by unbind client -+
+[22/Sep/2008:10:28:12 +0200] conn=2 op=-1 msgId=-1 - closed.+
system specyfication:
Solaris 10 x86 64-bit
DS 6.3 B2008.0311.0212 NAT

See http://forums.sun.com/thread.jspa?forumID=761&threadID=5202246 for a description of the problem and a workaround.
If you have a Sun support contract, you can request an escalation of CR 6637404.
Also, note that it looks like part of the documentation went missing. In DS5.2 the docs included an additional step
Chapter 11 Implementing Security
Configuring Client Authentication
SASL Authentication Through GSSAPI (Solaris Only)
http://docs.sun.com/source/816-6698-10/ssl.html#18500
ldapmodify -D 'cn=directory manager'
dn: cn=SASL,cn=security,cn=config
changetype: modify
add: dsSaslPluginsEnable
dsSaslPluginsEnable: GSSAPI
replace: dsSaslPluginsPath
dsSaslPluginsPath: /usr/lib/mps/sasl2/libsasl.so
modifying entry cn=SASL,cn=security,cn=config
ldap_modify: DSA is unwilling to perform
ldap_modify: additional info: Adding attributes is not allowed
-------------------------------------------------------------

ITunes bug updating iPod through proxy

This kept me busy for a couple of hours last night!
iTunes, running on a Mac, can download music and make purchases and look at your account using a proxy. However, it can't update your iPod. If you try you get the annoying message:
iTunes iPod software update server could not be contacted
I resolved it by moving to another network without a proxy, but it caused pretty major irritation.
It should be an easy bug to fix.

Fixed by not using a proxy. If you have a proxy, then you can't update your iPod through iTunes - and, because that is the only way you can do it now, you are stuck!

Help needed for using BASIC authentication through JDBCRealm

Help needed.
Hello,
I am doing a degree project, so far it works fine in my local machine, I need to try it on my virtual hosting (as it is a live server).
My project requires JDBCRealm, that is BASIC authentication loading access data from mysql database. Normally this setup can be done in Server.xml file, because my Tomcat hosting is a virtual one, I only have permission to access the web.xml file.
My question is: is it possible to get it done in an alternative way? In web.xml? Some properties file maybe?
Thank you very much.

You can set this up for your context using META-INF/context.xml instead of working with server.xml.
Make a directory called META-INF under your webapp ( it'll be at the same level as WEB-INF ). Under this, add a context.xml with all your context specific configuration including the realm. A sample is below
<?xml version="1.0" encoding="UTF-8"?>
<Context path="/myApp" reloadable="true">
    <Realm
        className="org.apache.catalina.realm.JDBCRealm"
        driverName="com.microsoft.jdbc.sqlserver.SQLServerDriver"
        connectionURL="jdbc:microsoft:sqlserver://127.0.0.1:1433;DatabaseName=myDB;SelectMethod=Cursor;"
        connectionName="username" connectionPassword="password"
        digest="MD5" userTable="users" userNameCol="userid" userCredCol="userpassword"
        userRoleTable="user_roles" roleNameCol="rolename"
    />
</Context>Hope this helps.
People on the forum help others voluntarily, it's not their job.
Help them help you.
Learn how to ask questions first: http://faq.javaranch.com/java/HowToAskQuestionsOnJavaRanch
----------------------------------------------------------------

ASA - cut through proxy authentication for RDP?

I know how to set this up on a router (dynamic access-list - lock and key)... But, I'm having trouble understanding how to setup OUTSIDE to INSIDE cut through proxy authentication for RDP.
OUTSIDE to INSIDE RDP is currently working.
I have 2 servers I want RDP open for..
[*]OUTSIDE 1.1.1.1 to INSIDE 10.10.70.100
[*]OUTSIDE 1.1.1.2 to INSIDE 10.10.50.200
What's required for OUTSIDE users to authenticate on the ASA before allowing port 3389 opens? I was hoping for is a way to SSH into this ASA, login with a special user, then have the ASA add a dynamic ACE on the OUTSISE interface to open 3389 for a designated time limit. Is this possible?
Here is my current config.
[code]
ASA Version 8.2(5)
hostname ASA5505
names
name 10.10.0.0 LANTraffic
name 10.10.30.0 SALES
name 10.10.40.0 FoodServices
name 10.10.99.0 Management
name 10.10.20.0 Office
name 10.10.80.0 Printshop
name 10.10.60.0 Regional
name 10.10.70.0 Servers
name 10.10.50.0 ShoreTel
name 10.10.100.0 Surveillance
name 10.10.90.0 Wireless
interface Ethernet0/0
description TO INTERNET
switchport access vlan 11
interface Ethernet0/1
description TO INSIDE 3560X
switchport access vlan 10
interface Ethernet0/2
shutdown
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
shutdown
interface Ethernet0/6
shutdown
interface Ethernet0/7
shutdown
interface Vlan1
no nameif
security-level 50
no ip address
interface Vlan10
description Cisco 3560x
nameif INSIDE
security-level 100
ip address 10.10.1.1 255.255.255.252
interface Vlan11
description Internet Interface
nameif OUTSIDE
security-level 0
ip address 1.1.1.1 255.255.255.224
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup OUTSIDE
dns server-group DefaultDNS
name-server 8.8.8.8
name-server 4.2.2.2
domain-name test.local
access-list RDP-INBOUND extended permit tcp any host 1.1.1.1 eq 3389
access-list RDP-INBOUND extended permit tcp any host 1.1.1.2 eq 3389
pager lines 24
logging enable
logging timestamp
logging trap warnings
logging device-id hostname
logging host INSIDE 10.10.70.100
mtu INSIDE 1500
mtu OUTSIDE 1500
ip verify reverse-path interface OUTSIDE
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
global (OUTSIDE) 1 interface
nat (INSIDE) 1 LANTraffic 255.255.0.0
static (INSIDE,OUTSIDE) tcp interface 3389 10.10.70.100 3389 netmask 255.255.255.255
static (INSIDE,OUTSIDE) tcp 1.1.1.2 3389 10.10.50.200 3389 netmask 255.255.255.255
access-group RDP-INBOUND in interface OUTSIDE
route OUTSIDE 0.0.0.0 0.0.0.0 1.1.1.1 1
route INSIDE LANTraffic 255.255.0.0 10.10.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http Management 255.255.255.0 INSIDE
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 10.10.70.100 255.255.255.255 INSIDE
ssh Management 255.255.255.0 INSIDE
ssh 0.0.0.0 0.0.0.0 OUTSIDE
ssh timeout 5
ssh version 2
console timeout 0
threat-detection basic-threat
threat-detection scanning-threat shun
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
username scott password CNjeKgq88PLZXETE encrypted privilege 15
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:1e9d278ce656f22829809f4c46b04a07
: end
[/code]

You're running ASA 8.2(5). In 8.4(2) Cisco added support for what they call Identity Firewall rules. That is, you can make access-lists entries specific to users (or object groups containing users).
There's an overview document on this posted here. It's a bit dated but I believe the only change is that Cisco is now preferring use of the more current Context Directory Agent (CDA) - a free VM they provide - vs. the deprecated AD agent (software service that runs on your DC).

How to use an authenticated user for a proxy call

Dear all,
I am currently working on a JEE application where the user needs to authenticate (for this I have configured the web.xml).
Now inside this application I need to do a proxy call to a PI webservice.
I would like to use the user credentials of the already logged in user in order to call the proxy.
What I don't want to do is to use a service user for the proxy call.
The code I am trying to call looks something like this:
     private IntegratedConfigurationIn getPort() throws Exception{
          IntegratedConfigurationIn port = null;
          try {
               IntegratedConfigurationInService service = null;
               service = new IntegratedConfigurationInService();
               port = (IntegratedConfigurationIn) service.getIntegratedConfigurationIn_Port();
              BindingProvider bp = (BindingProvider)port;
              bp.getRequestContext().put(BindingProvider.USERNAME_PROPERTY, user);
              bp.getRequestContext().put(BindingProvider.PASSWORD_PROPERTY, password);
              if (url.length() != 0)
                   bp.getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, url);
          catch (Exception ex){
               ex.printStackTrace();
          return port;
The examples I found to retrieve the userdata pointed to codes similar to this one:
public HttpServletRequest getHttpRequest() throws Exception {
          // Get runtime context
          Properties props = new Properties();
          props.put("domain", "true");
          Context initialContext = new InitialContext(props);
          ApplicationWebServiceContext wsContext = (ApplicationWebServiceContext) initialContext
                    .lookup(" /wsContext/ApplicationWebServiceContext");
          HttpServletRequest req = wsContext.getHttpServletRequest();
          return req;
com.sap.security.api.IUser sapUser = com.sap.security.api.UMFactory.getAuthenticator().getLoggedInUser(getHttpRequest(), null);
          IUser ep5User = com.sapportals.wcm.util.usermanagement.WPUMFactory.getUserFactory().getEP5User(sapUser);
Now I don't know how to bring it togehter and how to use an authenticated user for the BindingProvider.
I would appreciate any hints or ideas.

Peter,
from the first screenshot, what I understood is that, you are calling an inbound PI web service that is intended to create an integrated configuration object (this is used for whole lot of other reason completely) but not actually calling a development web service.
For this, you would have to generate your client classes from the WSDL provided by the PI developer for that particular service. Once you get those client classes generated, you could used the method provided in the other screenshot to extract the user and password and call the intended web service.
Vijay Konam

Strange behaviour when using connection pooling with proxy authentication

All
I have developed an ASP.NET 1.1 Web application that uses ODP.NET 9.2.0.4 accessing Oracle Database 8i (which is to be upgraded to 10g in the coming months). I have enabled connection pooling and implemented proxy authentication.
I am observing a strange behaviour in the live environment. If two users (User 1 and User 2) are executing SQL statements at the same time (concurrent threads in IIS), the following is occurring:
* User 1 opens a new connection, executes a SELECT statement, and closes this connection. The audit log, which uses the USER function, shows User 1 executed this statement.
* User 2 opens the same connection (before it is released to the connection pool?), excutes an INSERT statement, and closes this connection. The audit log shows User 1, not User 2, executed this statement.
Is this a known issue when using connection pooling with proxy authentication? I appreciate your help.
Regards,
Chris

Hi Chris,
I tried to reproduce your complaint, but was unable to. I didnt use auditting however, just a series of "select user from dual" with proxy authentication. You might want to see if you can put together a small complete testcase for this and open a sr with support.
Cheers
Greg

I use itunes to play music through my airport express but sometimes the songs cut out sporatically. a song will be playing along then all of a sudden there is intermittant music and silence. What could be causing this?

i use itunes to play music through my airport express but sometimes the songs cut out sporatically. a song will be playing along then all of a sudden there is intermittant music and silence. What could be causing this?

I finally resolved my problem after spending way too much time on it. I simply handed my 160GB iPod to my husband to put his fav Stones & Beatles songs on and I went back to my 80GB Microsoft Zune which has never disappointed me.
After spending so much time trying to figure this out I did finally take it back to Apple Store who performed a diagnostic and found there was a problem with the device. They replaced it with a refurbished one which has similar issues. All I wanted to do was listen to my music. Was that too much to ask? So I am happy to be free of this problematic device. No more Apple for me!!

Using Skype through proxy

Is it possible to use Skype through a proxy, and only Skype? I don't want other apps to work through proxy, just Skype.

Is it possible to use Skype through a proxy, and only Skype? I don't want other apps to work through proxy, just Skype.

Applet using socket connection always go through proxy server

Socket connection with socks always go through proxy server
We have two applets in different codebases using socket to talk to each other, until now nothing new, but the problem is that we are behind a proxy server with socks and because of that, the connection always go through the proxy server even with proxy override point to the applet machine. We have tried a lof of things and until now nothing worked, it looks like the socket is ignoring proxy override configuration. We would like to know if there is a way to solve this problem making the applets comunicate to each other ignoring the proxy server. It should happen when we set the plug-in option to "no proxy host", but it doesn't. Maybe it can be a bug of JVM, I don't know, just maybe, and if it's true, any other good idea would be welcome as well.
Thanks in advance.

Hi,
I am not very much sure if I can help you. In my previous experience, once you set the system property to use the proxy, then the jvm uses the proxy. If you want disable, in your code, you have to disable it.
like System.setProperty("socksProxyHost","someHost"), Properties props = System.getProperties(); props.remove(("socksProxyHost");

HT1473 I have always imported my cds into iTunes using one step called 'joining cd tracks' which is done under the "Advanced" drop down menu. I then went on with the process. Half way through the process today the "join tracks' choice greyed out. Not avai

I have always imported my cds (including books) into iTunes using one step called "join cd tracks" which is under the "Advanced" menu. Never a problem. But today I was importing a 10 disc book and on the 7th disc all of a sudden the choice to join cd tracks was greyed out. I have tried it with other discs. No luck. How can I get to this option again. I was not doing anything different so don't know what took away this choice. Can anyone help me?

Thought it had worked but soon found out it had not.
after further days of trying finally, solved it for me Yesterday.
turned off notifications when locked, and bingo, wow.
i have not turned off iCloud but location services are also off.
best thing to do I found was keep checking your usage, settings, general, usage, and flip down to bottom, if the standby and usage are similar there is a problem, if there is a big difference then all is ok. Just keep turning things off and on until the difference is very apparent.
something on my phone was keeping the phone alive even when turned off, and I think this was the phone repeatedly trying to update continually.
to me this is definitely down to the iOS, my wife has exactly same phone and iOS but hers doesn't have any problem and the battery lasts for days.
the guy at the Genius Bar told me to restore the phone via iTunes, not iCloud. This is because iCloud remembers the exact info from your phone and simply reinstates it when you restore, and this includes the iOS too.
when I get home from holidays that's what I'll do, or wait for iOS 8 in few weeks. But I'm so pleased I finally made it work, I was beginning to think ditch the phone and buy Samsung.
anyway anyone out there please try my final solution and let me know if it works for you?

How to authorize computer through latest iTunes using Windows?

I have downloaded the latest iTunes and have searched through the internet to try and find out how to authorize my computer through the latest iTunes on a Windows computer, but all I have found is for Mac computer. Can anybody help me?

Check out http://support.apple.com/kb/TS1389
I think that might help.
And this link if you need help finding the menu
http://www.jimyounkin.com/2012/12/turn-on-itunes-11s-missing-file-edit.html

ASA cut through proxy with RADIUS challenge response?

Have this working for IPSEC VPN on same box (tested on 8.2.1 and 8.2.3)
Want to do cut through proxy with challenge response - same ASA and same RADUIS server but using aaa authentication match command and this is what happens...
It looks like the ASA sends a completely different radius authentication request than with VPN authentication request. Is there any way to specify what request is sent?
What the RADIUS Server sees with ASA VPN auth - THIS WORKS OK (included for comparison)
Date: 15/11/2010
Time: 3:53:57 PM
Type: Information
Source: Server
Category: RADIUS
Code: I-006001
Description: A RADIUS Access-Request has been received.
AMID: 0xC8500B80B3D8F49C6CB37E5D32DA6682
Details:
Source Location : 10.xx.21.24
Client Location : 10.xx.21.230:1025
Request ID : 31
Password Protocol : PAP
Input Details : RADIUS Code:1, RADIUS Id:31, , User-Name:xxxx, User-Password:******, NAS-IP-Address:10.xx.21.230, NAS-Port:31, NAS-Port-Type:Virtual, vendor(9):attrib(1):0x1A2000000009011A69703A736F757263652D69703D31302E32312E352E313137, Calling-Station-Id:ip:source-ip=10.21.5.117
Action : Process
What the RADIUS Server sees with ASA cut thru - THIS FAILS (any help V welcome)
Date: 17/11/2010
Time: 2:29:31 PM
Type: Warning
Source: Server
Category: RADIUS
Code: W-006001
Description: An invalid RADIUS packet has been received.
AMID: 0xC19D988F83365F20151C3F6339DEC74B
Details:
Source Location : 10.xx.21.24:1812 (Authentication)
Client Location : 10.xx.21.230:1025
Reason : The sub-protocol of the received RADIUS packet cannot be determined
Request ID : 33
Input Details : 0x01210066055A8B6881266714BDB20380B9FE5FAC01066962333504060AC815E60506000000203D06000000051A2000000009011A69703A736F757263652D69703D31302E34302E352E3131311F1A69703A736F757263652D69703D31302E34302E352E313131
Request Type : Access-Request
Thanks in advance
IB

Hi Ian,
sorry for the late reaction - do you still need help with this?
The difference between the working (VPN) auth and the failing (CTP) auth seems to be that VPN is using PAP (so no challenge-response!) while the CTP is using MS-Chapv2
So my guess is that your Radius server does not support MS-Chapv2. If that is the case then you may want to try this:
aaa-server () host
no mschapv2-capable
Although this command is not really meant to be used in this scenario, so I'm not sure if it will work but I'm hoping it will make the ASA revert to PAP for all auth requests to this host.
Note that you won't be doing challenge/response, so your passwords will be transmitted over the wire (encrypted).
hth
Herbert

BPC Connection Through Proxy

Deal All,
We could not connect BPC through proxy server. Can anybody let me know any specific setting required.
Best Regards
Shesh

Sorin,
Thank you so much for the reply.
I think you are saying that when I connect that when I am connecting directly to BPCWEB it is saying knows you are authenticated to the windows domain. But when it gets it from the proxy server it is now not you anymore the BPCWEB server sees it coming from the proxy server NOT the windows domain.
So instead of DOMAIN/userID connecting it is PROXY/userID connecting. BPC doesn't know you. This cannot be the first time this has been seen.
Do you know a way around this? I am currently using sapwebdispatcher as my reverse proxy here, however I do not mind trying other products.
Would you have any recommendations on what your other clients use as a reverse proxy for BPC.
To simply things, we have DOMAIN users ---> Reverse proxy box ---> BPC Web .NET Server. We want to eliminte the ability for direct access to the BPC web .NET Server
Thanks again... any help would be great as we have been struggling for a few weeks to get this silly access issue resolved.
Edited by: Russell Hull on Feb 20, 2010 7:24 PM

ITunes using anonymous authentication through proxy

Similar Messages

Maybe you are looking for