<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=NL link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hai, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Im having trouble to get the </span></font><b><font size=1
color="#1e1e1e"><span style='font-size:9.0pt;color:#1E1E1E;font-weight:bold'>ext_kerberos_ldap_group_acl
working. </span></font></b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’ve read : <a
href="http://www.squid-cache.org/Versions/v3/3.5/manuals/ext_kerberos_ldap_group_acl.html"
title="blocked::http://www.squid-cache.org/Versions/v3/3.5/manuals/ext_kerberos_ldap_group_acl.html">http://www.squid-cache.org/Versions/v3/3.5/manuals/ext_kerberos_ldap_group_acl.html</a><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here is what i have checked / done already. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>My keytab file : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>klist -ekt /etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Keytab name: FILE:/etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>KVNO
Timestamp Principal<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>---- ------------------- ------------------------------------------------------<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> 1 06/08/2015 15:28:03
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD (des-cbc-crc)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> 1 06/08/2015 15:28:03
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD (des-cbc-md5)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> 1 06/08/2015 15:28:03 HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD
(arcfour-hmac)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The auth im using ( which is working fine )<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>auth_param negotiate program
/usr/lib/squid/negotiate_wrapper_auth \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>--kerberos /usr/lib/squid/negotiate_kerberos_auth -s
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>--ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego
--domain=NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>For testing im starting on commandline the group acl: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>/usr/lib/squid3/ext_kerberos_ldap_group_acl -D
YOUR.REALM.TLD -N internet-mail@NTDOMAIN -m 4 -s -i –d<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>kerberos_ldap_group.cc(278): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: INFO: Starting version 1.3.1sq<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_group.cc(382): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: INFO: Group list internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_group.cc(447): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: INFO: Group internet-mail Domain YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_netbios.cc(83): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: DEBUG: Netbios list internet-mail@NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_netbios.cc(156): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: DEBUG: Netbios name internet-mail Domain NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_lserver.cc(82): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: DEBUG: ldap server list NULL<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_lserver.cc(86): pid=20782 :2016/08/24 10:40:49|
kerberos_ldap_group: DEBUG: No ldap servers defined.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>when i test with the user group now. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>testuser internet-mail<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>kerberos_ldap_group.cc(371): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: INFO: Got User: testuser set default domain:
YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>kerberos_ldap_group.cc(376): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: INFO: Got User: testuser Domain: YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_member.cc(63): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: User domain loop: group@domain
internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_member.cc(65): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Found group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_ldap.cc(898): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Setup Kerberos credential cache<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(127): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Set credential cache to MEMORY:squid_ldap_21722<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(138): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Get default keytab file name<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(144): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Got default keytab file name
/etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(158): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Get principal name from keytab
/etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(169): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Keytab entry has realm name: YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(181): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Found principal name:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(196): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Got principal name
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initialising credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(169): pid=21722 :2016/08/24 10:57:39| kerberos_ldap_group:
DEBUG: Keytab entry has realm name: YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(181): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Found principal name:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(196): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Got principal name
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initialising credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(169): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Keytab entry has realm name: YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(181): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Found principal name:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(196): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Got principal name
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initialising credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(282): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Did not find a principal in keytab for domain
YOUR.REALM.TLD.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(283): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Try to get principal of trusted domain.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(297): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Keytab entry has principal:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initializing credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(297): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Keytab entry has principal:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initializing credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(297): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Keytab entry has principal:
HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(64): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error while initializing credentials from keytab :
Client 'HTTP/hostname.internet.domain.tld@YOUR.REALM.TLD' not found in Kerberos
database<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_krb5.cc(366): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Got no principal name<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_ldap.cc(903): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: ERROR: Error during setup of Kerberos credential cache<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_member.cc(76): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: INFO: User testuser is not member of group@domain
internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_member.cc(91): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Default domain loop: group@domain
internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>support_member.cc(119): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: Default group loop: group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>ERR<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>kerberos_ldap_group.cc(411): pid=21722 :2016/08/24 10:57:39|
kerberos_ldap_group: DEBUG: ERR<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I dont see what im missing here. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m running Debian Jessie, ldap is setup for SSL,
samba 4.4.5 and squid 3.5.19. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I did see something about kerberos and groups but i can find
that post. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>So anyone any suggestion/tip howto debug this or why im
getting “Error while initializing credentials from keytab”<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Greetz, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Louis<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>