We have set up authenticated proxy on our VPN segment to identify users. we used multi-realm authentication with IWA set to our VPN IP range. Some of our users are getting a "proxy authorization required" message when they try to get to external sites.
We are using Triton 7.7.3. The proxies are joined to the domain and we have the WCG fqdn in the intranet site zones. one question about that would be the format. is it supposed to be hostname.domain.com or do we need to put http:// in front of the fqdn?
i have been using VPN for over a week now from work and am unable to recreate the message. i originally thought was because the user didn't log off/on their computer, but they say they do that all the time. Other thoughts were that the time was off from the computer causing the kerberos tickets to expire, but that was not the case. the user account was also not locked.
has anyone experienced this? and what would be a good place to start getting to the bottom of it?