Proxy credentials not remembered

Question

Level 1

8 points

Proxy credentials not remembered

Dear all

please be assured we have tried many, many things already, including clearing caches, keychains, even fresh installs. We have many, many macs in use at our College, a good number of which suffer from this issue.

The OSX version varies, as does the model of Macbook, but the problem is often the same. The proxy credentials are in the keychain but Safari, App Store, Chrome and other apps do not seem to 'find' them. Alternatively I have tried assigning the proxy settings against HTTP and HTTPS proxy config in the Network System Preference pane, again this does not help. We also have a WPAD file in place so that auto proxy configuration works. And work it does! But sadly, while I can see that the autoconfig is working because the correct proxy server requests credentials, this method still does not cause the Macbook(s) to retrieve and use credentials.

This only seems to affect HTTPS connections, e.g. to https://www.google.co.uk - which of course is Safari's default in-line search.

My only clue so far is a line from the system log on one of the Macbooks, but it doesn't really give a fix - again this line is only generated and the problem seen when attempting to access an HTTPS site:

Nov 11 11:43:19 usersmacbook.ourdomain.com ocspd[411]: Authentication challenge received for "proxy.ourdomain.com:8080", unable to obtain proxy server credential from System keychain.

Please be assured the credentials are most definitely there!

Any help with this issue would be greatly appreciated - particularly with the frightening rate at which the number of students using Macbooks seems to be growing!

Kind regards

Richard

MacBook, OS X Mavericks (10.9)

Posted on Nov 11, 2013 3:52 AM

Reply

Answer 1

Nov 11, 2013 4:26 AM in response to The Rictus

I am experiencing the same:- and it's driving me crazy. Any help would be very gratefully acknowledged. This is on my work iMac12,1.

My MacPro at home doesn't have a proxy so I can't recreate the problem to analyse and disect it.

(Reply added so I'll be notified of any movement on this discussion/thread)

Reply

Answer 2

The Rictus Author

Level 1

8 points

Nov 11, 2013 4:32 AM in response to ttreen1950

Note - the credentials are stored in the LOGIN keychain, but it seems to be requesting the SYSTEM keychain - ttreen1950 could you say whether you are seeing the same info in your console? Go to system.log and type 'proxy' in the filter option 🙂

Reply

Answer 3

Nov 11, 2013 5:04 AM in response to The Rictus

Yup:-

Just the same:-

Nov 11 11:16:41 teds-new-mac.ad.mycompany.co.uk ocspd[537]: Authentication challenge received for "10.203.39.212:8080", unable to obtain proxy server credential from System keychain.

Nov 11 11:16:45 teds-new-mac.ad.mycompany.co.uk ocspd[537]: Authentication challenge received for "10.203.39.212:8080", unable to obtain proxy server credential from System keychain.

Nov 11 11:16:52 teds-new-mac.ad.mycompany.co.uk ocspd[537]: Authentication challenge received for "10.203.39.212:8080", unable to obtain proxy server credential from System keychain.

I'm at a loss.

Safari won't go on to ANY HTTPS address:- Swithched to Firefox which seems quite happy with it all.

Also, when I try the APP STORE, it generates multiple entries of the same line, and brings up the following box:-

The following line also appears in Console (system log):-

Nov 11 12:56:19 teds-new-mac.ad.mycompany.co.uk ocspd[1336]: You can specify the username and password for a proxy server with /usr/bin/security. Example: sudo security add-internet-password -a squiduser -l "HTTP Proxy" -P 3128 -r 'http' -s localhost -w squidpass -U -T /usr/sbin/ocspd /Library/Keychains/System.keychain

So it's DEFINITELY looking in the system keychain.

Q.

This seems too easy - but would copying the entry from login keychain and pasting it into system keychain solve the problem?

Or would it totally screw things up?

Message was edited by: ttreen1950

Reply

Answer 4

The Rictus Author

Level 1

8 points

Nov 11, 2013 4:57 AM in response to ttreen1950

Tried manually adding proxy auth to System Keychain - same problem remains... Same log entry generated...

Reply

Answer 5

Nov 11, 2013 5:30 AM in response to The Rictus

Ditto here...

App store is also repeatedly asking me to log in with my Apple ID (dialogue box 'rolls up' & then immediately reappears) - despite the download coming down very slowly (I think) in the background

Reply

Answer 6

Nov 11, 2013 6:02 AM in response to ttreen1950

I copied entries from LOGIN KEYCHAIN and pasted them into SYSTEM KEYCHAIN:

I let the download referred to above (Thunderbolt Firmware Update; Mail update for Mavericks, iTunes 11.1.3, iBooks update & Digital Camera Raw compatibility update) complete & restart.

And it all works - so far.

Safari logs into https pages withgout complaint

App Store tells me to update iMovie & iPhoto -

No entries in the system log about not getting authentication...

Can't see ANYTHING in the last download which could have affected the matter at hand:- maybe the new entries in the SYSTEM KEYCHAIN followed by a restart corrected it.

Must remember to update that in due course as I'm required to change my password every 28 days...

Whatever happened, at least it all seems to work now (fingers crossed) but I'd dearly love to know the whys & wherefores of this...

Reply

Answer 7

The Rictus Author

Level 1

8 points

Nov 12, 2013 4:05 AM in response to ttreen1950

Could I ask what version you're running?

I tried to copy the login items to the System Keychain yesterday and it refused to let me. That was on a 10.9 machine. I tried creating the items in the System Keychain - which it did let me do, but it didn't work...

Reply

Answer 8

Nov 12, 2013 5:06 AM in response to The Rictus

It's an iMac12,1 (21.5inch, mid 2011) running OS x 10.9 (13A603).

Yes, pasting into the System Keychain was, I found a not-very-intuitive process: but I forgot to mention it yesterday.

Having opened your Login Keychain, click once on the item to be copied and when it's highlighted, select "Copy" from the Edit menu or, of course, cmd+c.

Select the System Keychain:- DO NOT CLICK THE PADLOCK IN THE TOP LEFT TO UNLOCK IT.

From the Edit menu, select "Paste" or cmd+v.

You will then get a dialogue box,, enter your administrator's password and select "Modify Keychain" or just hit return, as it's the default entry.

I found a restart was in order before it recognised everything and would accept https pages without alert boxes, but YMMV.

Funnily enough - and this is where it seems counter-intuitive, if you do click on the padlock and unlock the System Keychain, "Paste" is greyed out in the Edit menu and cmd+v has no effect.

Exactly the opposite to what I'd expect..

Reply

Answer 9

The Rictus Author

Level 1

8 points

Nov 12, 2013 5:18 AM in response to The Rictus

Just tried on my Macbook and this worked!!

Not sure why it didn't work on the other Macbook I tried, but it let me drag and drop the two login items to the System Keychain... All of a sudden imessages that I tried to send a week ago have shot out and majorly confused my wife!!

I'm going to try this on a couple of other Macbooks, but so far, so good!

Thanks for your help ttreen1950 🙂

Reply

Answer 10

The Rictus Author

Level 1

8 points

Nov 12, 2013 5:27 AM in response to The Rictus

PS this ONLY seems to affect the HTTPS Proxy credentials, HTTP is not affected...

Reply

Answer 11

Nov 12, 2013 5:47 AM in response to The Rictus

Same with me:- only https affected.

But I'm glad it worked for you.

Could you mark my last posting "This answered my question", so others will see the subject and see a resolution has been found, and it might help other Mac users who are flummoxed.

Cheers,

Ted

Reply

Answer 12

The Rictus Author

Level 1

8 points

Nov 12, 2013 6:00 AM in response to ttreen1950

Done 🙂 Good work, sir!

Reply

Answer 13

tobias19

Level 1

0 points

Nov 15, 2013 3:56 AM in response to The Rictus

Unfortunately, it did not work for me. I added all login keychain entries to system with the closed padlock, but I'm still getting the annoying proxy messages

Reply

Answer 14

Nov 15, 2013 4:15 AM in response to tobias19

I take it you restarted after adding them to the System Keychain - it didn't work for me until I'd restarted.

Reply

Answer 15

tobias19

Level 1

0 points

Nov 15, 2013 4:19 AM in response to The Rictus

Yes, I restarted the system. It might be the case that the change reduced the number of proxy requests (it kind of feels a bit less), but I can't say for sure.

Reply