<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>So I finally tried it on my Squid Proxy.</div>
<div> </div>
<div>
<div>I edited the squid like this:</div>
<div> </div>
<div>external_acl_type ad_group_member_check ttl=120 %LOGIN /usr/lib/squid/ext_ldap_group_acl -d -R -K -S -b "dc=domain,dc=com" -D ProxyUser@domain.com -W /etc/squid/ldappass.txt -f "(&(sAMAccountName=%u)(memberOf=CN=%g,OU=Groups,DC=domain,DC=com))" -h my.domain.com</div>
<div> </div>
<div>ProxyUser is a AD-User I created and the file "ldappass.txt" contains the password for this user.</div>
<div>Now I did try to ask for specific groups with the help of this:</div>
<div> </div>
<div>acl LDAPLookup1 external ad_group_member_check Test1</div>
<div> </div>
<div>Test1 is a group in the AD and part of the OU "Groups".</div>
<div>But now I have the problem, that in the squid cache.log is written:</div>
<div>ext_ldap_group_acl: WARNING: LDAP search error 'Referral'</div>
<div> </div>
<div>So it seems like LDAP can not check the groups but I have no clue why.. Can someone help?</div>
<div> </div>
<div> </div>
<div>Regards,</div>
<div>Philipp</div>
<div> </div>
<div> </div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Sonntag, 24. Januar 2021 um 17:02 Uhr<br/>
<b>Von:</b> "Marek Greško" <mgresko8@gmail.com><br/>
<b>An:</b> heimarbeit123.99@web.de<br/>
<b>Cc:</b> squid-users@lists.squid-cache.org<br/>
<b>Betreff:</b> Re: [squid-users] Squid doesn't notice AD group changes</div>
<div name="quoted-content">Hello,<br/>
<br/>
that looks correct. Maybe I would add -B option to the<br/>
ext_ldap_group_acl helper to specify basedn for users.<br/>
<br/>
Marek<br/>
<br/>
<br/>
2021-01-24 10:06 GMT+01:00, heimarbeit123.99@web.de <heimarbeit123.99@web.de>:<br/>
> Thanks for your replies!<br/>
><br/>
> Yes, I did try "external_acl_type wbinfocheck %LOGIN<br/>
> /usr/lib/squid/ext_wbinfo_group_acl -K".<br/>
><br/>
> So if my fqdn would be "my.domain.com" it would be:<br/>
><br/>
> external_acl_type ad_group_member_check ttl=120 %LOGIN<br/>
> /usr/lib/squid/ext_ldap_group_acl -d -R -K -S -b "dc=domain,dc=com"<br/>
> -D 192.168.1.250@domain.com -W /etc/squid/ldappass.txt -f<br/>
> "(&(sAMAccountName=%u)(memberOf=CN=%g,OU=Groups,DC=domain,DC=com))" -h<br/>
> my.domain.com<br/>
><br/>
> for 192.168.1.250 being the IP from my Squid Proxy Server, right?<br/>
><br/>
> So I could ask for specific groups like this:<br/>
> acl Group1 ad_group_member_check TestGroup1<br/>
> acl Group2 ad_group_member_check TestGroup2<br/>
> and so on.. Am I right?<br/>
><br/>
> Thank you so far for your help!<br/>
><br/>
> Regads,<br/>
> Philipp<br/>
><br/>
> --<br/>
> Diese Nachricht wurde von meinem Android Mobiltelefon mit WEB.DE Mail<br/>
> gesendet.</div>
</div>
</div>
</div></div></body></html>