<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi All,<br>
</p>
<p> I'm wondering if anyone can help me with the following issue I'm having getting various non-domain devices (mainly tablets, but some non-domain windows and apple mac computers) working with the basic_ldap_auth helper. I've had a good search of
the mailing list, as well as a huge trawl of the internet, but I cannot get the helper to work within squid, and all information points to the fact that I've got the command set up as it should be. </p>
<p><br>
</p>
<p>Testing on the command line works perfectly, with the helper returning the correct information. As soon as I attempt to do the same through squid, it fails, returning technically nothing.<br>
</p>
<p><br>
</p>
<p>I've even attempted different versions, from 3.2 right through to the latest 3.5, just in case there was a bug with one of the builds on the helper. All have the same result.<br>
</p>
<p><br>
</p>
<p>In production, I've got the proxy working with domain devices via kerberos authentication perfectly, but the basic ldap authentication fails. So I've got a development system where the config has been stripped right back to check the LDAP authentication,
and the results are the same, so I know that I'm not having problems with any other authentication method failover.<br>
</p>
<p><br>
</p>
<p>If I put the following line on the cli, then a domain username and password, everything returns normally:<br>
</p>
<p><br>
</p>
<p>/usr/lib64/squid/basic_ldap_auth -d -v 3 -R -b "dc=domain,dc=com" -D "CN=KerbAuth,OU=ServiceAccounts,DC=domain,DC=com" -W /etc/squid/kerbauth -f sAMAccountName=%s -u uid -h windows2012r2.domain.com<br>
</p>
<p><br>
</p>
<p>Output:<br>
</p>
<p><br>
</p>
<div>ctest ctest3</div>
<div>basic_ldap_auth.cc(684): pid=20130 :user filter 'sAMAccountName=ctest', searchbase 'dc=domain,dc=com'</div>
<div>basic_ldap_auth.cc(739): pid=20130 :attempting to authenticate user 'CN=Test User,OU=Dept1,OU=Dept2,OU=Dept3,OU=Dept4,OU=Company,DC=domain,DC=com'</div>
<div>OK<br>
</div>
<div><br>
</div>
<div>However, when used within the squid.conf file, when a user attempts to authenticate, the output in the cache.log is this:<br>
</div>
<div><br>
</div>
<div>
<div>basic_ldap_auth.cc(684): pid=20006 :user filter 'sAMAccountName=0', searchbase 'dc=domain,dc=com'<br>
</div>
<div>basic_ldap_auth.cc(706): pid=20006 :Ldap search returned nothing<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I'm at a complete loss as to what to do next.<br>
</div>
<div><br>
</div>
<div>If there is any further information that I can provide, I would be more than happy to provide it.<br>
</div>
<div><br>
</div>
<div>Cheers,<br>
</div>
<div> Monty<br>
</div>
<div><br>
</div>
<div>OS: Centos 6.6<br>
</div>
<div><br>
</div>
<div>Squid.conf file:<br>
</div>
<div><br>
</div>
<div>
<div>dns_v4_first on</div>
<div>dns_nameservers 10.7.128.21 10.7.128.22</div>
<div>negative_dns_ttl 5 minutes</div>
<div>forwarded_for delete</div>
<div>via off</div>
<div>cache_replacement_policy heap LFUDA</div>
<div>cache_swap_low 90<br>
</div>
<div>cache_swap_high 95</div>
<div>cache_dir aufs /cache 8192 16 256</div>
<div>cache_mem 256 MB</div>
<div>memory_pools on</div>
<div>maximum_object_size_in_memory 10 MB</div>
<div>maximum_object_size 50 MB</div>
<div>logfile_rotate 10<br>
</div>
<div>quick_abort_min 16 KB</div>
<div>quick_abort_max 16 KB</div>
<div>log_icp_queries off</div>
<div>client_db off</div>
<div>buffered_logs on</div>
<div><br>
</div>
<div></div>
<div><span style="font-size: 12pt;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">/usr/lib64/squid/basic_ldap_auth -d -v 3 -R -b "dc=domain</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">,dc=com</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"
-D "CN=KerbAuth,OU=ServiceAccounts,DC=domain,</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">DC=com</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);"> -W
/etc/squid/kerbauth -f sAMAccountName=%s -u uid </span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">-</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">h</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);"> windows2012r2</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">.domain.com</span></span></div>
<div><span style="font-size: 12pt;">auth_param basic children 80 startup=20 idle=10 concurrency=2</span><br>
</div>
<div>auth_param basic credentialsttl 5 hours<br>
</div>
<div><br>
</div>
<div>cache_peer 10.0.100.192 parent 8080 3130 no-query</div>
<div>cache_effective_user squid<br>
</div>
<div>cache_effective_group squid</div>
<div>visible_hostname Domain-Cache</div>
<div><br>
</div>
<div>acl SSL method CONNECT</div>
<div><br>
</div>
<div>acl SSL_ports port 443</div>
<div>acl SSL_ports port 1494 # Citrix XenApp</div>
<div>acl Safe_ports port 80</div>
<div>acl Safe_ports port 21</div>
<div>acl Safe_ports port 443 # https</div>
<div>acl Safe_ports port 1494 # Citrix XenApp</div>
<div>acl Safe_ports port 70 # ftp</div>
<div>acl Safe_ports port 210 # https</div>
<div>acl Safe_ports port 1025-65535 # gopher</div>
<div>acl Safe_ports port 280 # wais</div>
<div>acl Safe_ports port 488 # unregistered ports</div>
<div>acl Safe_ports port 591 # http-mgmt</div>
<div>acl Safe_ports port 777 # gss-http</div>
<div>acl Safe_ports port 143 # IMAP</div>
<div>acl Safe_ports port 993 # IMAP over SSL<br>
</div>
<div>acl Safe_ports port 82</div>
<div>acl GLOW_SMTP port 587</div>
<div>acl GLOW_IMAP port 993</div>
<div>acl CONNECT method CONNECT # filemaker</div>
<div><br>
</div>
<div>acl goodusers proxy_auth REQUIRED</div>
<div>deny_info ERR_BANNED badusers</div>
<div><br>
</div>
<div>http_access allow manager localhost</div>
<div><span style="font-size: 12pt;">http_access deny all !goodusers</span><br>
</div>
<div>http_access allow all goodusers<br>
</div>
<div>http_access deny manager</div>
<div>http_access deny !Safe_ports</div>
<div>http_access deny CONNECT !SSL_ports</div>
<div>http_access deny all</div>
<div><br>
</div>
<div>http_port 3128</div>
<div>redirector_bypass off</div>
<div>coredump_dir /var/spool/squid</div>
<div><br>
</div>
<div>refresh_pattern ^ftp: 1440 20% 10080</div>
<div>refresh_pattern ^gopher: 1440 0% 1440</div>
<div>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0</div>
<div>refresh_pattern . 0 20% 4320</div>
<div>delay_pools 0</div>
<div><br>
</div>
<div>access_log stdio:/var/log/squid/access.log<br>
</div>
<br>
</div>
<div><br>
<br>
</div>
<br>
<br>
</div>
<p><br>
</p>
</div>
</body>
</html>