<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 69.6pt 70.85pt 69.6pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=NL link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I think you forgot in your test, that you may need to modify the
default kerberos ticket used. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I suggest you change you config a bit to something like <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>external_acl_type internet-win-allowed %LOGIN /usr/local/libexec/squid/ext_kerberos_ldap_group_acl
\<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-D YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-g allowed-internet@YOUR.REALM.TLD
\<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-N
NTDOMAIN@YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-S <a
href="mailto:dc1.your.dnsdomain.tld@YOUR.REALM.TLD:dc2.your.dnsdomain.tld@YOUR.REALM.TLD">dc1.your.dnsdomain.tld@YOUR.REALM.TLD:dc2.your.dnsdomain.tld@YOUR.REALM.TLD</a>
\<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Now test it. start like this : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>/usr/local/libexec/squid/negotiate_kerberos_auth \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-D YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-g
allowed-internet@YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-N
NTDOMAIN@YOUR.REALM.TLD \<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-S <a
href="mailto:dc1.your.dnsdomain.tld@YOUR.REALM.TLD:dc2.your.dnsdomain.tld@YOUR.REALM.TLD">dc1.your.dnsdomain.tld@YOUR.REALM.TLD:dc2.your.dnsdomain.tld@YOUR.REALM.TLD</a>
\<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:35.4pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>-d <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>(-d = debug ) <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Test with –S and point to your server, does it work? <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Test again with –S , does it works, no? Change the default keytab
for te test.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>KRB5_KTNAME=/etc/squid/keytab.SQUID-HTTP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>export KRB5_KTNAME<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Type a username belonging to you group your testing with, hit enter. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>And in the end you should see : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>support_member.cc(69): pid=10396 :2016/09/16 10:39:07|
kerberos_ldap_group: INFO: User testuser is member of group@domain allowed-internet@YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>OK<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>kerberos_ldap_group.cc(408): pid=10396 :2016/09/16 10:39:07|
kerberos_ldap_group: DEBUG: OK<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>with search for the kdc in krb5.conf <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>[libdefaults]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> default_realm = YOUR.REALM.TLD<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> dns_lookup_kdc = true<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> dns_lookup_realm = false<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>and now when it works adjust you parameters to your needs. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>( like the : children-max=1 ttl=3600 negative_ttl=3600 ) <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Greetz, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Louis<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> </span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> squid.conf:</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> auth_param negotiate program</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> /usr/local/libexec/squid/negotiate_kerberos_auth -di -s</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> HTTP/proxy.example.com</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> auth_param negotiate children 1</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> auth_param negotiate keep_alive on</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> </span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> external_acl_type squid_kerb_ldap children-max=1 ttl=3600 negative_ttl=3600
%LOGIN</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> /usr/local/libexec/squid/ext_kerberos_ldap_group_acl -di -S
1.2.3.4@ -g</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> linux@</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> acl ldap_group_check external squid_kerb_ldap</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>> http_access deny !ldap_group_check</span></font></p>
</div>
</body>
</html>