<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Tekst zonder opmaak Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.TekstzonderopmaakChar
{mso-style-name:"Tekst zonder opmaak Char";
mso-style-priority:99;
mso-style-link:"Tekst zonder opmaak";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NL" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText"><span lang="EN-GB">support_member.cc(91): pid=2166 :2018/02/19 08:23:59| kerberos_ldap_group: DEBUG: Default domain loop: group@domain ADGroupRaamregeling@BNH.LOCAL<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">support_member.cc(119): pid=2166 :2018/02/19 08:23:59| kerberos_ldap_group: DEBUG: Default group loop: group@domain ADGroupRaamregeling@BNH.LOCAL<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">support_member.cc(63): pid=2166 :2018/02/19 09:54:21| kerberos_ldap_group: DEBUG: User domain loop: group@domain ADGroupRaamregeling@BNH.LOCAL<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">support_member.cc(65): pid=2166 :2018/02/19 09:54:21| kerberos_ldap_group: DEBUG:
<b><span style="color:#00B050">Found group@domain ADGroupRaamregeling@BNH.LOCAL<o:p></o:p></span></b></span></p>
<p class="MsoPlainText"><span lang="EN-GB">support_member.cc(76): pid=2166 :2018/02/19 09:54:21| kerberos_ldap_group:
<b><span style="color:red">INFO: User Jeroen.Ruijter is not member of group@domain ADGroupRaamregeling@BNH.LOCAL</span></b><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">So user authenticated for proxy the goup is found but the user is not a member, but I’m certainly a member<o:p></o:p></span></p>
<div style="mso-element:para-border-div;border:none;border-bottom:double windowtext 2.25pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoPlainText" style="border:none;padding:0cm"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">Squid info<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">bhlnx03:~ # squid -v<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">Squid Cache: Version 3.5.21<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">Service Name: squid<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">configure options: '--host=x86_64-suse-linux-gnu' '--build=x86_64-suse-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share'
'--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/lib' '--localstatedir=/var' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-dependency-tracking' '--disable-strict-error-checking' '--sysconfdir=/etc/squid'
'--libexecdir=/usr/sbin' '--datadir=/usr/share/squid' '--sharedstatedir=/var/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/run/squid.pid' '--with-dl' '--enable-disk-io' '--enable-storeio' '--enable-removal-policies=heap,lru' '--enable-icmp' '--enable-delay-pools'
'--enable-esi' '--enable-icap-client' '--enable-useragent-log' '--enable-referer-log' '--enable-kill-parent-hack' '--enable-arp-acl' '--enable-ssl-crtd' '--with-openssl' '--enable-forw-via-db' '--enable-cache-digests' '--enable-linux-netfilter' '--with-large-files'
'--enable-underscores' '--enable-auth' '--enable-auth-basic' '--enable-auth-ntlm' '--enable-auth-negotiate' '--enable-auth-digest' '--enable-external-acl-helpers=LDAP_group,eDirectory_userip,file_userip,kerberos_ldap_group,session,unix_group,wbinfo_group'
'--enable-stacktraces' '--enable-x-accelerator-vary' '--with-default-user=squid' '--disable-ident-lookups' '--enable-follow-x-forwarded-for' '--disable-arch-native' 'build_alias=x86_64-suse-linux-gnu' 'host_alias=x86_64-suse-linux-gnu' 'CFLAGS=-fmessage-length=0
-grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -fPIE -fPIC -DOPENSSL_LOAD_CONF' 'LDFLAGS=-Wl,--as-needed -Wl,--no-undefined -Wl,-z,relro,-z,now -pie' 'CXXFLAGS=-fmessage-length=0 -grecord-gcc-switches
-O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -fPIE -fPIC -DOPENSSL_LOAD_CONF' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'<o:p></o:p></span></p>
<div style="mso-element:para-border-div;border:none;border-bottom:double windowtext 2.25pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoPlainText" style="border:none;padding:0cm"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="mso-fareast-language:NL">-----Oorspronkelijk bericht-----<br>
Van: squid-users [mailto:squid-users-bounces@lists.squid-cache.org] Namens Amos Jeffries<br>
Verzonden: vrijdag 16 februari 2018 18:58<br>
Aan: squid-users@lists.squid-cache.org<br>
Onderwerp: Re: [squid-users] kerberos authentication with kerberos groups</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 17/02/18 02:02, Jeroen Ruijter wrote:<o:p></o:p></p>
<p class="MsoPlainText">> I'm trying to replace my basic ldap authentication by kerberos single
<o:p></o:p></p>
<p class="MsoPlainText">> sign on.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">NP: Despite what some claim, SSO is not unique to NTLM and Kerberos authentication. It is a behaviour of the tools used. As such it can be done with *any* authentication type if the tools used perform the necessary behaviour.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> The user can succesfully login with single sign on, but I have
<o:p></o:p></p>
<p class="MsoPlainText">> restriction on groups and that is where it goes wrong.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">What exactly does this "going wrong" look like?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Also, what version of Squid are you working with?<o:p></o:p></p>
<p class="MsoPlainText">(the "squid -v" output please)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I would like to use -r to trim the domain name, but when I do so it
<o:p></o:p></p>
<p class="MsoPlainText">> seems to work even less.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Someone any ideas what to try, I believe the system is loking wrong in
<o:p></o:p></p>
<p class="MsoPlainText">> active directory but adding -b OU=Users,DC=yyy,DC=local does not help
<o:p></o:p></p>
<p class="MsoPlainText">> me further<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">You have some things looking for ".local" and others for ".LOCAL". I'm not sure if case insensitivity exists in all those places they are being used, so that is one potential cause of problems.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> =======<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> auth_param negotiate program /usr/sbin/negotiate_wrapper_auth -d
<o:p></o:p></p>
<p class="MsoPlainText">> --ntlm /usr/bin/ntlm_auth --diagnostics <o:p></o:p></p>
<p class="MsoPlainText">> --helper-protocol=squid-2.5-ntlmssp<o:p></o:p></p>
<p class="MsoPlainText">> --domain=yyy --kerberos /usr/sbin/negotiate_kerberos_auth -d -s
<o:p></o:p></p>
<p class="MsoPlainText">> GSS_C_NO_NAME<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> auth_param negotiate children 20 startup=0 idle=1<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> auth_param negotiate keep_alive off<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> external_acl_type XXX_InternetAllowed ttl=3600 negative_ttl=3600
<o:p></o:p></p>
<p class="MsoPlainText">> %LOGIN /usr/sbin/ext_kerberos_ldap_group_acl -b <o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">> OU=Users,OU=BenH,DC=yyy,DC=local -g </span>
<a href="mailto:AD_XXX_InternetAllowed@yyy.LOCAL"><span lang="EN-GB" style="color:windowtext;text-decoration:none">AD_XXX_InternetAllowed@yyy.LOCAL</span></a><span lang="EN-GB">
<o:p></o:p></span></p>
<p class="MsoPlainText">> -d<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> external_acl_type RestrictedAdult ttl=3600 negative_ttl=3600 %LOGIN
<o:p></o:p></p>
<p class="MsoPlainText">> /usr/sbin/ext_kerberos_ldap_group_acl -b <o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">> OU=Users,OU=BenH,DC=yyy,DC=local -g </span>
<a href="mailto:ADGroupRestrictedAdult@yyy.LOCAL"><span lang="EN-GB" style="color:windowtext;text-decoration:none">ADGroupRestrictedAdult@yyy.LOCAL</span></a><span lang="EN-GB">
<o:p></o:p></span></p>
<p class="MsoPlainText">> -d<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> acl XXX_InternetAllowed external XXX_InternetAllowed<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> acl XXX_Adult external XXX_Adult<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">...<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> http_access deny auth !XXX_InternetAllowed<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The above says the users entire login is to be rejected if they are not a member of the XXX_InternetAllowed group.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">That should work but it is better to reject failed logins fully first, then do the group checks separately.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Like this:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">http_access deny !auth<o:p></o:p></p>
<p class="MsoPlainText">http_access deny !XXX_InternetAllowed all<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> http_access deny XXX_Adult XXX_AdultX<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">you could gain a fair bit of performance back by making that check the dstdomain before the slow external lookup:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> http_access deny XXX_AdultX XXX_Adult all<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> http_access allow localnet<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> http_access allow localhost<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> http_access deny all<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> ========<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">...<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> support_ldap.cc(342): pid=7612 :2018/02/16 11:50:07|<o:p></o:p></p>
<p class="MsoPlainText">> kerberos_ldap_group: DEBUG: Search ldap server with bind path
<o:p></o:p></p>
<p class="MsoPlainText">> CN=Schema,CN=Configuration,DC=bnh,DC=local and filter:<o:p></o:p></p>
<p class="MsoPlainText">> (ldapdisplayname=samaccountname)<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> support_ldap.cc(345): pid=7612 :2018/02/16 11:50:07|<o:p></o:p></p>
<p class="MsoPlainText">> kerberos_ldap_group: DEBUG: Found 0 ldap entries<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> support_ldap.cc(350): pid=7612 :2018/02/16 11:50:07|<o:p></o:p></p>
<p class="MsoPlainText">> kerberos_ldap_group: DEBUG: Determined ldap server not as an Active
<o:p></o:p></p>
<p class="MsoPlainText">> Directory server<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> support_ldap.cc(1061): pid=7612 :2018/02/16 11:50:07|<o:p></o:p></p>
<p class="MsoPlainText">> kerberos_ldap_group: ERROR: Error determining ldap server type:<o:p></o:p></p>
<p class="MsoPlainText">> Operations error<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> support_member.cc(76): pid=7612 :2018/02/16 11:50:07|<o:p></o:p></p>
<p class="MsoPlainText">> kerberos_ldap_group: INFO: User Administrator is not member of
<o:p></o:p></p>
<p class="MsoPlainText">> group@domain <a href="mailto:AD_XXX_InternetAllowed@YYY.LOCAL">
<span style="color:windowtext;text-decoration:none">AD_XXX_InternetAllowed@YYY.LOCAL</span></a><o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Looks like it is working to me.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The helper tries several methods of locating a server, two fail but the third seems to work and produces the above result.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Amos<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">squid-users mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:squid-users@lists.squid-cache.org"><span style="color:windowtext;text-decoration:none">squid-users@lists.squid-cache.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.squid-cache.org/listinfo/squid-users"><span style="color:windowtext;text-decoration:none">http://lists.squid-cache.org/listinfo/squid-users</span></a><o:p></o:p></p>
</div>
</body>
</html>