<HTML><HEAD><TITLE></TITLE>
<META content="text/html; charset=UTF-8" http-equiv=Content-Type>
<STYLE type=text/css>.felamimail-body-blockquote {margin: 5px 10px 0 3px;padding-left: 10px;border-left: 2px solid #000088;} </STYLE>
</HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>Hi Enrico,</DIV>
<DIV> </DIV>
<DIV> The Kerberos helper will authenticate only for now ( There is
a now code to get the group information, but it is not further
processed). It does not do anything to group membership like the winbind
cache. Also keep in mind Kerberos cache for about 10 hours the ticket on
the client machine. If the user does not lock/unlock his PC there
won’t be any update to the cached ticket and therefore not to the group
membership information in the ticket either. </DIV>
<DIV> </DIV>
<DIV>Regards</DIV>
<DIV>Markus </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style="FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inline">
<DIV>"Heine, Enrico" <independence@data-core.org> wrote in message
news:c821a938e46c6278b4cc39912760b408bb84f83c@data-core.org...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style="FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inline">Hello
together,<BR><BR>My Issue is the following: <BR><BR>Using Squid3 with Kerberos
Auth works just fine but does not update the users group membership in the
winbind cache of samba as for examle ntlm_auth does.<BR><BR>So when using
/usr/lib/squid3/negotiate_kerberos_auth for Kerberos, the auth works, but group
memberships for my user as example are never updated, when I comment this auth
helper then it gets updated because then I use ntlm_auth for ntlmssp<BR>So if I
have a new group eg: My_Test , then I can check this like this: <BR><BR>wbinfo
-n My_Test -> returns SID of My_Test<BR>wbinfo -Y SID -> returns mapped
GID<BR>wbinfo -r myuser | grep GID -> GID is not listed!!<BR><BR>getent group
My_Test -> returns: myuser is member of that group! So just in my account
"myuser" it is not listed (wbinfo -r myuser | grep GID -> GID is not
listed!!) but ext_wbinfo_group_acl is checking my group membership based on the
commands listed above.<BR><BR>Commenting Kerberos auth in the squid conf, so
that only ntlm_auth is used and requesting one website to be sure to have done
an auth, works. So then the GID is listed in the output of wbinfo -r
myuser<BR><BR>How can I ensure that my memberships are getting updated using
/usr/lib/squid3/negotiate_kerberos_auth as it does work with ntlm_user? Or is
there another auth helper that can be used for Kerberos that is doing what
ntlm_user does automatically after an successfull authentication?<BR><BR>My
Squid Config for Auth Helpers looks like
this:<BR><BR>######################################################### Kerberos
#########################################################<BR>#auth_param
negotiate program /usr/lib/squid3/negotiate_kerberos_auth -r -s
HTTP/myserver.MYDOMAIN@MYDOMAIN<BR>#auth_param negotiate children
300<BR>#auth_param negotiate keep_alive
on<BR><BR>######################################################### NTLM
#########################################################<BR>auth_param ntlm
program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp<BR>auth_param
ntlm children 50<BR>auth_param ntlm keep_alive
off<BR><BR>######################################################### BASIC
#########################################################<BR>auth_param basic
program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic<BR>auth_param basic
children 50<BR>auth_param basic credentialsttl 2 hours<BR>auth_param basic realm
Windows Authentication required<BR>auth_param basic casesensitive
off<BR><BR>Also I am using the following to check group memberships, which is
working fine !! with all auth helpers !! and it is much faster than the slow
Kerberos group check, I assume that this helper is updating automatically the
winbind group cache, which is the reason that the group itself is beeing
recognized and I am also a member of that group when I check that specific group
via getent group My_Test<BR><BR>external_acl_type nt_group ttl=60
children-max=300 children-startup=50 %LOGIN /usr/lib/squid3/ext_wbinfo_group_acl
-K<BR><BR>Software Versions used:<BR>- Squid Cache: Version 3.4.8<BR>- Samba
& winbindd Version 4.1.17-Debian<BR>- Distri: Debian Jessie<BR><BR><BR><SPAN
id=felamimail-body-signature>-- <BR><SPAN
id=felamimail_inline_felamimail-body-signature>-- <BR>Best regards,<BR>Enrico
Heine<BR><BR>This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the system
manager. This message contains confidential information and is intended only for
the individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system. If you are not the intended recipient you are
notified that disclosing, copying, distributing or taking any action in reliance
on the contents of this information is strictly
prohibited.</SPAN></SPAN><BR><BR>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>http://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>