Open Radar

 
Summary:
When applying a Proxy setting to use a PAC file (Automatic Proxy Configuration) via Configuration Profile, Kerberos auth is not honored in many applications, notably Safari. Chrome works fine with this howeever. Manually setting the value in the network interface works fine. Also when the profile is applied, it does display the typical "greyed out" behavior that profile applied settings usually show.

Steps to Reproduce:
Apply a PAC file for a proxy that utilizes Kerberos auth in your Network Interface settings, by checking the "Automatic Proxy Configuration" option under Proxies. We use Enterprise Connect to get our Kerberos tickets. Once that is set, you should be able to browse websites in Safari. Once it is verified to be worked, remove the setting and apply it via profile instead.

Expected Results:
Both should operate the same, whether via manual setting or profile. Web browsing should not prompt for auth as the proxy uses the kerberos auth.

Actual Results:
When changing from manual setting to profile, Safari is unable to navigate to any sites without the proxy prompting for auth. Chrome is fine.