<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
span.E-mailStijl17
{mso-style-type:personal;
font-family:Arial;
color:navy;}
span.E-mailStijl18
{mso-style-type:personal;
font-family:Arial;
color:navy;}
span.E-mailStijl20
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=NL link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Hello Markus, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thank you for the explanation, that helped
a lot. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I use the </span></font><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:black'>TLS_CACERTFILE in the init script now and that works for me . <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>( in debian the /etc/default/squid )<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>>>The helper tries to
“authenticate” squid to AD as a user with the found SPN name, so
the UPN must be the same as the SPN. There is no easy way to query what
the UPN for the SPN is. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Ah, this helped identify-ing so other
small things to. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>>>msktutil (my preferred tool)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Since i try to use only debian packages
the msktutil is not available for me. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>>>Also msktutil (my preferred tool)
creates a machine account not a user account in AD. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>>>The reason I prefer this is that
often user accounts have a global password policy e.g. change every 60 days
otherwise it will be locked. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>>>machine accounts do not have that
limitation. But as I said it is just my preference.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Thats not correct in my optionion. A the
computer account, works the (almost) same an user account. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Like a computer account = a user account.
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> some pointers :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><a
href="https://technet.microsoft.com/en-us/library/cc731641(v=ws.11).aspx">https://technet.microsoft.com/en-us/library/cc731641(v=ws.11).aspx</a><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><a href="https://adsecurity.org/?p=280">https://adsecurity.org/?p=280</a>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>I used a seperated user since i wanted to
have 2 proxy on 1 service account, but due to the UPS/SPN thing,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>thats not options anymore, not thats a
problem, I’ll change to add the computer to the samba domain and <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>add the UPN/SPN on the computer account
where needed.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Which maybe even a better option.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Thanks again for you replies. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Best regards, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Louis<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>Van:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> squid-users
[mailto:squid-users-bounces@lists.squid-cache.org] <b><span style='font-weight:
bold'>Namens </span></b>Markus Moeller<br>
<b><span style='font-weight:bold'>Verzonden:</span></b> zaterdag 27 augustus
2016 16:52<br>
<b><span style='font-weight:bold'>Aan:</span></b>
squid-users@lists.squid-cache.org<br>
<b><span style='font-weight:bold'>Onderwerp:</span></b> Re: [squid-users] ext_kerberos_ldap_group_acl
problem ( 2 minorbugsmaybe )</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Hi,<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> I would say they are bugs.
The first “issue” is as you say more about understanding the
difference between UPN and SPN and how the tools use them. The helper
tries to “authenticate” squid to AD as a user with the found SPN
name, so the UPN must be the same as the SPN. There is no easy way to
query what the UPN for the SPN is. <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> Also msktutil (my preferred tool)
creates a machine account not a user account in AD. The reason I prefer this is
that often user accounts have a global password policy e.g. change every 60
days otherwise it will be locked. machine accounts do not have that limitation.
But as I said it is just my preference. <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> Regarding the certifcate
check I do not use any ldap.conf settings. I require an export
TLS_CACERTFILE=/mydir/myfile.pem in the squid startup file.
Maybe in the next version I see how I can determine the right ldap.conf file
and check if the CACERTFILE variable is already set.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Kind regards<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'>Markus<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:black'> <o:p></o:p></span></font></p>
</div>
<div style='border:none black 1.0pt;border-left:solid black 3.0pt;padding:0cm 0cm 0cm 4.0pt;
margin-left:3.75pt'>
<div>
<div>
<p class=MsoNormal><font size=3 color=black face=Calibri><span
style='font-size:12.0pt;font-family:Calibri;color:black'>"L.P.H. van
Belle" <belle@bazuin.nl> wrote in message news:vmime.57bdb617.37c8.575130a1134f9a07@ms249-lin-003.rotterdam.bazuin.nl...<o:p></o:p></span></font></p>
</div>
</div>
</div>
<div style='border:none black 1.0pt;border-left:solid black 3.0pt;padding:0cm 0cm 0cm 4.0pt;
margin-left:3.75pt'>
<div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Ok reply to myself so other users know
this also.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>if you create a user for the HTTP services
and you dont use </span></font><font color=black><span lang=EN
style='color:black'>msktutil but like me samba-tool or something else. </span></font><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Read : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><a
href="http://wiki.squid-cache.org/ConfigExamples/Authenticate/Kerberos">http://wiki.squid-cache.org/ConfigExamples/Authenticate/Kerberos</a>
carefully. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>and the clue was this line for me. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN
style='font-size:10.0pt;font-family:Arial;color:black'>Squid "login"
to Windows Active Directory or Unix kdc as user <HTTP/<fqdn-squid>@DOMAIN.COM>.
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN
style='font-size:10.0pt;font-family:Arial;color:black'>This requires Active
Directory to have an <u>attribute userPrincipalname</u> set to
<HTTP/<fqdn-squid>@DOMAIN.COM><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span lang=EN
style='font-size:10.0pt;font-family:Arial;color:black'>for the associated
acount. This is usaully done by using msktutil. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>But this is not done by samba-tools <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>samba-tool setup fro squid i used, was as
followed. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>samba-tool user create squid1-service
--description="Unprivileged user for SQUID1-Proxy Services"
--random-password <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>samba-tool user setexpiry squid1-service
–noexpiry<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>samba-tool spn add HTTP/proxy.internal.domain.tld
squid1-service<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Now this results in : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>My UPN was set to the
username@internal.domain.tld ( as it should ). <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>My SPN was set to
HTTP/proxyserver.internal.domain.tld@REALM ( as is should ) <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>samba-tool spn list squid1-service <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>squid1-service<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>User
CN=squid1-service,OU=Service-Accounts,OU=XXXX,DC=XXXXX,DC=XXXX,DC=XX has the
following servicePrincipalName:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
HTTP/proxy.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>
HTTP/proxy.internal.domain.tld@YOUR.REALM.T<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Now i changed my UPN from
username@internal.domain.tld to the (SPN name)
HTTP/proxyserver.internal.domain.tld@REALM <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Solved my initial problem. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>This should be in my optionion be changed
to search for the SPN in ext_kerberos_ldap_group.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Now i have LDAPS messages, see below, im
adding the _ldaps SRV records now ,but i dont get why im getting : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Set certificate file for ldap server to
/etc/ssl/certs/cert.pem.(Changeable through setting environment variable
TLS_CACERTFILE)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Im already having :
TLS_CACERT /etc/ssl/certs/ca-certificates.crt <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Which contains the needed certs.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Did i find 2 small bugs here? <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Or is this a “Debian” related
thing? <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Debug output. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>/usr/lib/squid3/ext_kerberos_ldap_group_acl
-g internet-mail@YOUR.REALM.TLD -D YOUR.REALM.TLD -N internet-mail@NTDOMAIN -s
-i -d<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>kerberos_ldap_group.cc(278): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: INFO: Starting version 1.3.1sq<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_group.cc(382): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: INFO: Group list
internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_group.cc(447): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: INFO: Group internet-mail
Domain YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_netbios.cc(83): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: DEBUG: Netbios list
internet-mail@NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_netbios.cc(156): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: DEBUG: Netbios name
internet-mail Domain NTDOMAIN<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_lserver.cc(82): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: DEBUG: ldap server list NULL<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_lserver.cc(86): pid=6902
:2016/08/24 16:10:07| kerberos_ldap_group: DEBUG: No ldap servers defined.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>testuser internet-mail<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>kerberos_ldap_group.cc(371): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: INFO: Got User: testuser set default
domain: YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>kerberos_ldap_group.cc(376): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: INFO: Got User: testuser Domain:
YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_member.cc(63): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: User domain loop:
group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_member.cc(65): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Found group@domain
internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(898): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Setup Kerberos credential cache<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(127): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set credential cache to
MEMORY:squid_ldap_6902<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(138): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Get default keytab file name<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(144): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Got default keytab file name
/etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(158): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Get principal name from keytab
/etc/squid/keytab.PROXYSERVER-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(169): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Keytab entry has realm name:
YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(181): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Found principal name:
HTTP/proxy.internal.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(196): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Got principal name HTTP/proxy.internal.domain.tld@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_krb5.cc(260): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Stored credentials<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(927): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Initialise ldap connection<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(931): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Enable SSL to ldap servers<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(933): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Canonicalise ldap server name for domain
YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(289): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: ERROR: Error while resolving service
record _ldaps._tcp.YOUR.REALM.TLD with res_search<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(71): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: ERROR: res_search: Unknown service
record: _ldaps._tcp.YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(379): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved SRV
_ldap._tcp.YOUR.REALM.TLD record to samba-dc2.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(379): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved SRV
_ldap._tcp.YOUR.REALM.TLD record to samba-dc1.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 1 of
YOUR.REALM.TLD to samba-dc1.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 2 of
YOUR.REALM.TLD to samba-dc1.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 3 of
YOUR.REALM.TLD to samba-dc1.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 4 of
YOUR.REALM.TLD to samba-dc2.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 5 of
YOUR.REALM.TLD to samba-dc2.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(207): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Resolved address 6 of
YOUR.REALM.TLD to samba-dc2.internal.domain.tld<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(407): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Adding YOUR.REALM.TLD to list<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(443): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Sorted ldap server names for
domain YOUR.REALM.TLD:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(445): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Host:
samba-dc1.internal.domain.tld Port: 389 Priority: 0 Weight: 100<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(445): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Host:
samba-dc2.internal.domain.tld Port: 389 Priority: 0 Weight: 100<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_resolv.cc(445): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Host: YOUR.REALM.TLD Port: -1
Priority: -2 Weight: -2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(942): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Setting up connection to ldap server
samba-dc1.internal.domain.tld:389<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(786): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set SSL defaults<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(531): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Enable server certificate check for ldap
server.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(544): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set certificate file for ldap server to
/etc/ssl/certs/cert.pem.(Changeable through setting environment variable
TLS_CACERTFILE)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(800): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while setting start_tls for ldap
server: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(953): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Bind to ldap server with SASL/GSSAPI<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_sasl.cc(276): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: ldap_sasl_interactive_bind_s error: Can't
contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(957): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while binding to ldap server with
SASL/GSSAPI: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(942): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Setting up connection to ldap server
samba-dc2.internal.domain.tld:389<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(786): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set SSL defaults<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(531): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Enable server certificate check for ldap
server.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(544): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set certificate file for ldap server to
/etc/ssl/certs/cert.pem.(Changeable through setting environment variable
TLS_CACERTFILE)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(800): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while setting start_tls for ldap
server: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(953): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Bind to ldap server with SASL/GSSAPI<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_sasl.cc(276): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: ldap_sasl_interactive_bind_s error: Can't
contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(957): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while binding to ldap server with
SASL/GSSAPI: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(942): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Setting up connection to ldap server
YOUR.REALM.TLD:389<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(786): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set SSL defaults<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(531): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Enable server certificate check for ldap
server.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(544): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Set certificate file for ldap server to
/etc/ssl/certs/cert.pem.(Changeable through setting environment variable
TLS_CACERTFILE)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(800): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while setting start_tls for ldap
server: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(953): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Bind to ldap server with SASL/GSSAPI<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_sasl.cc(276): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: ldap_sasl_interactive_bind_s error: Can't
contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(957): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: ERROR: Error while binding to ldap server with
SASL/GSSAPI: Can't contact LDAP server<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(979): pid=6902 :2016/08/24
16:10:12| kerberos_ldap_group: DEBUG: Error during initialisation of ldap
connection: No such file or directory<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_ldap.cc(1048): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Error during initialisation
of ldap connection: No such file or directory<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_member.cc(76): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: INFO: User testuser is not member of
group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_member.cc(91): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Default domain loop:
group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>support_member.cc(119): pid=6902
:2016/08/24 16:10:12| kerberos_ldap_group: DEBUG: Default group loop:
group@domain internet-mail@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'> </span></font><font size=2
color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'><o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
color=black face=Calibri><span style='font-size:12.0pt;font-family:Calibri;
color:black'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=3 color=black face=Calibri><span
style='font-size:12.0pt;font-family:Calibri;color:black'>_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
http://lists.squid-cache.org/listinfo/squid-users<o:p></o:p></span></font></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>