ext_kerberos_sid_group_acl8
Usage
ext_kerberos_sid_group_acl [-d]
[-h]
-p
Principal
Name
-D
Domain
Controller
-b
Base
DN
-G
Group1:Group2
Overview
ext_kerberos_sid_group_acl is an installed executable script. It uses ldapsearch from Openldap to lookup the name of a AD group sid.
This helper must be used in with the negotiate_kerberos_auth helper in a Microsoft AD or Samba environment.
It reads from the standard input the domain username and a list of group sids and tries to match the group SIDs to the AD group sids.
Options
-
-d -
Write debug info to stderr.
-
-h -
Print the help.
-p principal name
|
Principal name in squid keytab to use for ldap authentication to AD |
|---|---|
-D domain controller
|
Domain controller to contact to lookup group SID |
-b base DN
|
Base DN for ldap search |
-G AD group name
|
AD group name to be used for SID lookup. List separated by a colon (:) |
Configuration
auth_param negotiate program /path/to/negotiate_wrapper_auth -d \--ntlm /path/to/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain example.com \--kerberos /path/to/negotiate_kerberos_auth -d -s GSS_C_NO_NAME -k /path/to/squid.keytab -t noneexternal_acl_type sid_check %LOGIN %note{group} /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2acl squid_allow external sid_checkacl allowed_group external sid_checkhttp_access allow allowed_group
If the local perl interpreter is in a unusual location it may need to be added:
external_acl_type sid_check %LOGIN %note{group} /path/to/perl /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2Questions
Questions on the usage of this program can be sent to the Squid Users mailing list <[email protected]>