We use krb5 enforcing proxies (Squid) in our environment. We can allow a verify specific set of auth bypasses (still has to hit the proxy, as thats enforced on the OSX NIC as well as by Cisco AnyConnect profiles) to which we have already added desktop.parallels.com however now in 10.10.3 (inc supplemental) and PDE 10.1.3 (28868) we're finding a vanilla install attempting a Ubuntu download is not able to access http://download.parallels.com/desktop/v10/appliances.xml and results in a 407 (no auth). Will PDE10 (and PDE11) fully obey kerberos5 authentication for all HTTP/HTTPS traffic? If not, and in the immediate future, we would need a comprehensive list of all domains PDE uses for connectivity and for what content, but we are unable to simply wildcard allow *.parallels.com
