<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:メイリオ;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@メイリオ";}
/* Style Definitions */
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"書式なし \(文字\)";
margin:0mm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:メイリオ;}
span.a
{mso-style-name:"書式なし \(文字\)";
mso-style-priority:99;
mso-style-link:書式なし;
font-family:メイリオ;}
.MsoChpDefault
{mso-style-type:export-only;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="JA" link="#0563C1" vlink="#954F72" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoPlainText"><span lang="EN-US">Hi, this is Kawai.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Now, I'm trying to set up squid4.x on centOS, but, have one issue.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Please let me send inquiry as followings.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">### Requirement ###<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">The squid is required as follows.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">1. Kerberos auth with Active Directory : auth_param ..... <- Success<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">2. "Security group" check which is gotten from AD : external_acl_type ...(using ext_kerberos_ldap_group_acl) <- success<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">3. Using different outgoing IP based on "Security group" : tcp_outgoing_address + external_acl
<span style="color:red;background:yellow;mso-highlight:yellow"><- fail</span><span style="color:red"> (can not work)</span><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">=== sample configuration which I tested. (but, it did not work</span><span lang="EN-US" style="font-family:"Courier New"">…</span><span lang="EN-US">) ===<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">external_acl_type kerberos_ldap_group1 ttl=3600 negative_ttl=3600 %LOGIN /path/to/ext_kerberos_ldap_group_acl
</span><span lang="EN-US" style="font-family:"Courier New"">−</span><span lang="EN-US">g GROUP1<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">external_acl_type kerberos_ldap_group2 ttl=3600 negative_ttl=3600 %LOGIN /path/to/ext_kerberos_ldap_group_acl
</span><span lang="EN-US" style="font-family:"Courier New"">−</span><span lang="EN-US">g GROUP2<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">acl group1 external kerberos_ldap_group1<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">acl group2 external kerberos_ldap_group2<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">tcp_outgoing_address 10.1.0.1 group1<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">tcp_outgoing_address 10.1.0.2 group2<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">### Inquiry ###<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Based on the web site, </span><span lang="EN-US" style="font-family:"Courier New"">“</span><span lang="EN-US">tcp_outgoing_address</span><span lang="EN-US" style="font-family:"Courier New"">”</span><span lang="EN-US">
is NOT support "external_acl". Because the external_acl type is slow.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">In this case, how to configure the squid.conf to satisfy my requirement?<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Please let me inform your comment and knowledge.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">Thanks in advance.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">-------------------------------------<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">h.kawai@ntt.com<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">-------------------------------------<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>