<font size=2 face="sans-serif">Thanks Eliezer for reply.</font>
<br><font size=2 face="sans-serif">Its is working now for be perfectly
with below command with -d option gives helpful debug info to troubleshoot.</font>
<br>
<br><font size=2 face="Courier New">external_acl_type AD_Group %LOGIN /usr/lib64/squid/squid_ldap_group
-P -R -b "DC=ABCD,DC=GOV,DC=IN" -D svcproxy -w 123456789 -f "(&(objectclass=person)(userPrincipalName=%v)(memberof=cn=%a,ou=InternetAccess,ou=Groups,dc=ABCD,dc=GOV,dc=IN))"
-h abcd.gov.in -s sub -v 3 -d</font>
<br>
<br><font size=2 face="sans-serif">Currently I have configure squid with
AD kerberos auth. also url access restricted based on AD group membership.</font>
<br>
<br><font size=2 face="sans-serif">Now I observed, is that when I add any
user to one of the AD group which allowed in squid. it is not accepting
the changes until I restart the squid service.</font>
<br><font size=2 face="sans-serif">Is this the way squid behave or do I
need to follow different procedure. So as user added to AD group it will
recognised by squid on the fly without restarting squid service.</font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks & Regards<br>
Nilesh Suresh Gavali<br>
Tata Consultancy Services<br>
3rd Floor, Tithebarn House<br>
Tithebarn Street<br>
Liverpool - L2 2NZ<br>
United Kingdom<br>
Mailto: nilesh.gavali@tcs.com<br>
Website: </font><a href=http://www.tcs.com/><font size=2 face="sans-serif">http://www.tcs.com</font></a><font size=2 face="sans-serif"><br>
____________________________________________<br>
Experience certainty. IT Services<br>
Business Solutions<br>
Consulting<br>
____________________________________________<br>
<br>
Tata Consultancy Services Limited , incorporated with limited liability
and registered with Registrar of Companies, Mumbai, India - No: 11-84781<br>
HQ : Nirmal Building , 9th Floor, Nariman Point, Mumbai - 400 021, India
- Registered in UK : 18 Grosvenor Place, London SW1X 7HS -
BR :007627<br>
</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Eliezer Croitoru <eliezer@ngtech.co.il></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">'Nilesh Gavali' <nilesh.gavali@tcs.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">squid-users@lists.squid-cache.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">20/06/2016 10:06</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">RE: [squid-users]
URL access based on AD group membership</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 color=#004080 face="Calibri">Hey Nilesh,</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">Did you tried to test it
in any way outside of squid?</font>
<br><font size=2 color=#004080 face="Calibri">Like in a command line as
a self running program?</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">Eliezer</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Arial Rounded MT Bold">----</font>
<br><a href=http://ngtech.co.il/lmgtfy/><font size=2 color=#0082bf face="Arial Rounded MT Bold"><u>Eliezer
Croitoru</u></font></a><font size=2 color=#004080 face="Arial Rounded MT Bold"><br>
Linux System Administrator<br>
Mobile: +972-5-28704261<br>
Email: eliezer@ngtech.co.il</font>
<br><img src=cid:_4_0A18A2A80A18A03C00336CF180257FD8 style="border:0px solid;">
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 face="Calibri"><b>From:</b> squid-users [</font><a href="mailto:squid-users-bounces@lists.squid-cache.org"><font size=2 face="Calibri">mailto:squid-users-bounces@lists.squid-cache.org</font></a><font size=2 face="Calibri">]
<b>On Behalf Of </b>Nilesh Gavali<b><br>
Sent:</b> Friday, June 17, 2016 5:25 PM<b><br>
To:</b> squid-users@lists.squid-cache.org<b><br>
Subject:</b> [squid-users] URL access based on AD group membership</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=2 face="Arial">Team;</font><font size=3 face="Times New Roman">
</font><font size=2 face="Arial"><br>
Need expert help here,</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
here is my set up - as of now squid integrated with Windows 2012R2 AD,
SSO with kerberos - working fine. <br>
Now I want to restrict Internet access for user based on their AD group
membership. I tried loads of options from various site but no luck. not
sure what is going wrong.</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
here is my squid config, and cache.log o/p. </font><font size=3 face="Times New Roman"><br>
</font><font size=2 face="Arial"><br>
=============================</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
# Recommended minimum configuration:</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s </font><a href=mailto:HTTP/proxy02.abcd.gov.in@ABCD.GOV.IN><font size=2 color=#0082bf face="Courier New"><u>HTTP/proxy02.abcd.gov.in@ABCD.GOV.IN</u></font></a><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
auth_param negotiate children 10</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
auth_param negotiate keep_alive on</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
auth_param basic credentialsttl 2 hours</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
acl ad_auth proxy_auth REQUIRED</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
#AD Group membership</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
external_acl_type AD_Group %LOGIN /usr/lib64/squid/squid_ldap_group -P
-R -b "DC=ABCD,DC=GOV,DC=IN" -D svcproxy -w 123456789 -f "(&(objectclass=person)(userPrincipalName=%u)(memberof=cn=%g,ou=InternetAccess,ou=Groups,dc=ABCD,dc=GOV,dc=IN))"
-h abcd.gov.in -s sub -v 3 -d</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
acl infrateam external AD_Group lgInternetAccess</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
acl windowsupdate dstdomain "/etc/squid/sitelist/infra_update_site"</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
acl manager proto cache_object</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
acl localhost src 127.0.0.1/32 ::1</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Example rule allowing access from your local networks.</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# Adapt to list your (internal) IP networks from where browsing</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# should be allowed</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl localnet src 10.0.0.0/8 # RFC1918 possible
internal network</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl localnet src 172.16.0.0/12 # RFC1918 possible
internal network</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl localnet src 192.168.0.0/16 # RFC1918 possible
internal network</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl localnet src fc00::/7 # RFC 4193 local private
network range</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl localnet src fe80::/10 # RFC 4291 link-local (directly
plugged) machines</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
acl SSL_ports port 443</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 80
# http</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 21
# ftp</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 443
# https</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 70
# gopher</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 210
# wais</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 1025-65535 # unregistered
ports</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 280
# http-mgmt</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 488
# gss-http</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 591
# filemaker</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl Safe_ports port 777
# multiling http</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
acl CONNECT method CONNECT</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
# Recommended minimum Access Permission configuration:</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
# Only allow cachemgr access from localhost</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access allow manager localhost</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access deny manager</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
# Deny requests to certain unsafe ports</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access deny !Safe_ports</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Deny CONNECT to other than secure SSL ports</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access deny CONNECT !SSL_ports</font><font size=3 face="Times New Roman">
<br>
<br>
</font><font size=2 face="Courier New"><br>
# We strongly recommend the following be uncommented to protect innocent</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# web applications running on the proxy server who think the only</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# one who can access services on "localhost" is a local user</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#http_access deny to_localhost</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
#</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
# Example rule allowing access from your local networks.</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# Adapt localnet in the ACL section to list your (internal) IP networks</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
# from where browsing should be allowed</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
http_access deny infrateam windowsupdate</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access allow ad_auth</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
# And finally deny all other access to this proxy</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_access deny all</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
# Squid normally listens to port 3128</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
http_port 8080</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
never_direct allow all</font><font size=3 face="Times New Roman"> <br>
</font><font size=2 face="Courier New"><br>
cache_peer xx.xx.2.108 parent 8080 0 default</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#dns_nameservers DNSSVR.abcd.gov.in</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
dns_nameservers XX.XX.2.108</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# We recommend you to use at least the following line.</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
#hierarchy_stoplist cgi-bin ?</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Uncomment and adjust the following to add a disk cache directory.</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
cache_dir ufs /var/spool/squid 2048 16 256</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Leave coredumps in the first cache dir</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
coredump_dir /var/spool/squid</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Log forwarding to SysLog</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
access_log syslog:local1.info</font><font size=3 face="Times New Roman">
<br>
</font><font size=2 face="Courier New"><br>
# Add any of your own refresh_pattern entries above these.</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
refresh_pattern ^ftp:
1440 20% 10080</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
refresh_pattern ^gopher: 1440
0% 1440</font><font size=3 face="Times New Roman">
</font><font size=2 face="Courier New"><br>
refresh_pattern -i (/cgi-bin/|\?) 0 0%
0</font><font size=3 face="Times New Roman"> </font><font size=2 face="Courier New"><br>
refresh_pattern . 0
20% 4320</font><font size=3 face="Times New Roman">
</font><font size=2 face="Arial"><br>
======================================</font><font size=3 face="Times New Roman">
</font><font size=2 face="Arial"><br>
cache.log o/p-</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
Connected OK</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
group filter '(&(objectclass=person)(</font><a href="mailto:userPrincipalName=da.853438@ABCD.GOV.IN)(memberof=cn=lgInternetAccess,ou=InternetAccess,ou=Groups,dc=abcd,dc=gov,dc=in))"><font size=2 color=#0082bf face="Arial"><u>userPrincipalName=da.853438@ABCD.GOV.IN)(memberof=cn=lgInternetAccess,ou=InternetAccess,ou=Groups,dc=abcd,dc=gov,dc=in))</u></font></a><font size=2 face="Arial">',
searchbase 'DC=ABCD,DC=GOV,DC=IN'</font><font size=3 face="Times New Roman">
</font><font size=2 face="Arial"><br>
======================================</font><font size=3 face="Times New Roman">
<br>
<br>
</font><font size=2 face="Arial"><br>
Thanks & Regards<br>
Nilesh Suresh Gavali</font>
<p><font size=3 face="Times New Roman">=====-----=====-----=====<br>
Notice: The information contained in this e-mail<br>
message and/or attachments to it may contain <br>
confidential or privileged information. If you are <br>
not the intended recipient, any dissemination, use, <br>
review, distribution, printing or copying of the <br>
information contained in this e-mail message <br>
and/or attachments to it are strictly prohibited. If <br>
you have received this communication in error, <br>
please notify us by reply e-mail or telephone and <br>
immediately and permanently delete the message <br>
and any attachments. Thank you</font>
<p>