<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
</div>
Hi All,
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">Thanks a lot!</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">Issue has been solved, hope it's useful for other people if they encounter the same situation as me.</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--------------------------------------------</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--require-membership-of="IBM\Domain Users" with Quotation Mark is not supported, has to be removed as:</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--require-membership-of=IBM\Domain_Users</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">But what if Domain Group must has a space, use SID to instead of Domain Group Name :</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--require-membership-of=S-1-5-21-1386769244-779028218-18449361</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--------------------------------------------</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">debug:</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">To reduce unnecessary logs, it's good to set debug level as</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">debug_options 29,9</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">To get SID by winbind</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">wbinfo -n "IBM\Domain Users"</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">To test ntlm_auth
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">ntlm_auth --username=Administrator --require-membership-of="IBM\Domain_Users"</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">OR</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">ntlm_auth --username=Administrator --require-membership-of=IBM\\Domain_Users</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">OR</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">ntlm_auth --username=Administrator --require-membership-of="S-1-5-21-1386769244-779028218-18449361"</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">OR</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">ntlm_auth --username=Administrator --require-membership-of=S-1-5-21-1386769244-779028218-18449361</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: EmojiFont,Calibri,Helvetica,sans-serif,'Apple Color Emoji','Segoe UI Emoji', NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size: 12pt;">
To join computer as a Domain Member without modify krb5.conf manually. <span title=":微笑:" id="🙂">
🙂</span></div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">realm join --user=Administrators ibm.local -v</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: EmojiFont,Calibri,Helvetica,sans-serif,'Apple Color Emoji','Segoe UI Emoji', NotoColorEmoji,'Segoe UI Symbol','Android Emoji',EmojiSymbols; font-size: 12pt;">
But Samba need to be configured manually. <span title=":微微皱眉:" id="🙁">🙁</span></div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">--------------------------------------------</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">Working for me on CentOS7 + Squid4.5 + Windows AD
<br>
</div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;"><br>
</div>
<div><font color="#808080" face="Comic Sans MS" size="1" style="font-size: 8pt;">Best regards.</font><font color="#808080" face="Comic Sans MS"><br>
</font><b><font color="#000000" face="Comic Sans MS"><font>TOM</font></font><font face="Comic Sans MS">.WANG</font></b></div>
<div id="signature"><br>
<div>
<div id="appendonsend"></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<hr tabindex="-1" style="width: 98%; display: inline-block;">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size: 11pt;"><b>发件人:</b> squid-users <squid-users-bounces@lists.squid-cache.org> 代表 L.P.H. van Belle <belle@bazuin.nl><br>
<b>发送时间:</b> 2019年2月21日 10:14<br>
<b>收件人:</b> squid-users@lists.squid-cache.org<br>
<b>主题:</b> Re: [squid-users] The issue NTLM_AUTH with --require-membership-of</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size: 11pt;">
<div class="PlainText">I think you problem has todo NT1. <br>
<br>
I assum you already tried the setting in smb.conf : <br>
ntlm auth = ntlmv1-permitted <br>
(which is the alias for yes) <br>
<br>
<br>
And which samba/ntlm_auth version it this? Standard centos? <br>
I must say i noob in Centos, so i'll shown you what i know from debian. <br>
And it might be better to switch to kerberos auth. <br>
<br>
I know there are problems with the groups in ntlm_auth and its detection.<br>
If i recall right, a patch passed recently, so waiting for that on the next samba version.
<br>
<br>
I use the following.<br>
<br>
auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \<br>
--kerberos /usr/lib/squid/negotiate_kerberos_auth -s HTTP/$(hostname -f)@MY_REALM \<br>
--ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego --domain=NTDOM<br>
<br>
With ldap fallback<br>
auth_param basic program /usr/lib/squid/basic_ldap_auth -R -v 3 \<br>
-b "ou=Office,dc=some,dc=domain,dc=tld" \<br>
-D ldap-bind@MY_REALM \<br>
-W /etc/squid/private/ldap-bind \<br>
-f sAMAccountName=%s \<br>
-H ldaps://dc1.FQDN \<br>
-H ldaps://dc2.FQDN<br>
<br>
The ldap-bind account, needs, no pre-check on kerberos auth and disable passwd expire.
<br>
<br>
The group part, now im not using it myself but per example. Should be something like this.
<br>
<br>
Basicly its : <br>
Search for %LOGIN from this point : DC=office,DC=some,DC=domain,DC=tld And get person-%a from group Proxygroups<br>
<br>
external_acl_type ldapgroup %LOGIN /usr/lib/squid/squid_ldap_group -b DC=office,DC=some,DC=domain,DC=tld \<br>
-f (&(objectclass=person)(cn=%v)(groupMembership=cn=%a,ou=Proxygroups,DC=office,DC=some,DC=domain,DC=tld)) \<br>
-D ldap-bind@MY_REALM \<br>
-W /etc/squid/private/ldap-bind \<br>
-H ldaps://dc1.FQDN \<br>
-H ldaps://dc2.FQDN<br>
<br>
<br>
external_acl_type AD_Group %LOGIN /usr/lib64/squid/squid_ldap_group -b DC=office,DC=some,DC=domain,DC=tld \<br>
-s sub \<br>
-R -v3 \<br>
-D ldap-bind@MY_REALM \<br>
-W /etc/squid/private/ldap-bind \<br>
-f "(&(objectclass=person)(userPrincipalName=%v)(memberof=cn=%a,ou=Proxygroups,DC=office,DC=some,DC=domain,DC=tld))" \<br>
-H ldaps://dc1.FQDN \<br>
-H ldaps://dc2.FQDN<br>
<br>
I Hope this helps a bit. <br>
<br>
Greetz, <br>
<br>
Louis<br>
<br>
<br>
<br>
> -----Oorspronkelijk bericht-----<br>
> Van: squid-users <br>
> [<a href="mailto:squid-users-bounces@lists.squid-cache.org">mailto:squid-users-bounces@lists.squid-cache.org</a>] Namens
<br>
> Amos Jeffries<br>
> Verzonden: donderdag 21 februari 2019 10:18<br>
> Aan: squid-users@lists.squid-cache.org<br>
> Onderwerp: Re: [squid-users] The issue NTLM_AUTH with <br>
> --require-membership-of<br>
> <br>
> On 21/02/19 9:35 pm, WANG TOM wrote:<br>
> > <br>
> --------------------------------------------------------------<br>
> --------------------------------<br>
> > And I have tested run ntlm_auth directly, it looks successfully.<br>
> > "ntlm_auth --require-membership-of='IBM\Domain Users'<br>
> > --username=Administrators --password=123456<br>
> > NT_STATUS_OK: The operation completed successfully. (0x0)"<br>
> > <br>
> --------------------------------------------------------------<br>
> --------------------------------<br>
> > I have no idea what I have missed or made mistake, could <br>
> someone can help.<br>
> > <br>
> <br>
> Very likely that whitespace in the parameter string. Squid does not<br>
> support double-quote encoding of most parameters.<br>
> <br>
> That means the helper will be passed two different environment<br>
> arguments. One being "--require-membership-of='IBM\Domain".<br>
> The second being "Users'"<br>
> <br>
> IIRC you can probably %-encode that (as "IBM\Domain%20Users").<br>
> <br>
> <br>
> If not that then you are going to have to debug what the <br>
> helper is doing.<br>
> <br>
> <br>
> NP: This helper is provided by Samba, it is not part of Squid. So<br>
> questions about its abilities and encodings supported are a <br>
> question for<br>
> their help channels. Someone here _might_ know, but do not <br>
> count on that.<br>
> <br>
> <br>
> Amos<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> squid-users@lists.squid-cache.org<br>
> <a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
> <br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>