<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 6 Oct 2022, at 03:40, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" class="">squid3@treenet.co.nz</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 6/10/22 02:29, Djerk Geurts wrote:<br class=""><blockquote type="cite" class="">Hi,<br class="">I’ve got DLAP auth working against FreeIPA, but now I’m trying to get LDAP group all controls working. Initially I used the local unix group filter, which works great as the machine running Squid is able to query group membership through pam. But then I found that nested group membership didn’t work. So now I’m trying to query group membership via LDAP and failing miserably.<br class="">My config:<br class="">auth_param basic program /usr/lib/squid/basic_ldap_auth -v 3 -b "cn=users,cn=accounts,dc=DOMAIN,dc=COM" -D "uid=squid-ldap,cn=sysaccounts,cn=etc,dc=DOMAIN,dc=COM" -W "/etc/squid/squid-ldap.cred" -u uid -H <a href="LDAPS://ipa.domain.com:636" class="">LDAPS://ipa.domain.com:636</a> <<a href="ldaps://ipa.domain.com:636" class="">ldaps://ipa.domain.com:636</a>><br class="">[…]<br class=""></blockquote><br class="">To clarify, does the above description mean login with this helper works fine?<br class=""></div></div></blockquote><div><br class=""></div><div>Yes, normal logins work fine if I don’t use the group filtering in http_access</div></div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">> -b "cn=groups,cn=accounts,dc=DOMAIN,dc=COM" \<br class="">> -f "(&(cn=%g)(member=uid=%u))" \<br class="">> ...<br class=""><br class="">You can add '-d' (lower case) to get a debug trace in cache.log about what is happening inside the helper.<br class=""></div></div></blockquote><div><br class=""></div>Thank you, I’d seen the flag just not where the logs would end up and of course checked all but cache.log…</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">You can use that to confirm the user/group details are arriving properly and the filter string is correct before it goes sent to LDAP.<br class=""><br class="">Also, see whether LDAP is having connectivity issues, or search issues, or something else is going on.<br class=""><br class="">FWIW, the above reads to me like you are looking up the existence of the group rather than the existence of a specific user within a group. My LDAP knowledge is weak, so I may be wrong about that.<br class=""></div></div></blockquote><div><br class=""></div>Yeah, I’ve been wondering this too and my LDAP knowledge is quite poor. And it turns out that you're absolutely right.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class="">This ldap search works fine:<br class="">user@ipa:~$ ldapsearch -x -D 'cn=Directory Manager' -W -b "cn=groups,cn=accounts,dc=DOMAIN,dc=COM" '(&(cn=proxy)(member=uid=user,*))'<br class=""></blockquote><br class="">I notice that there is an extra ',*' after the username in this filter string which is missing on the helper one.<br class=""></div></div></blockquote><div><br class=""></div>The ldapsearch works fine with and without it. The ,* is meant to match the rest of the DN but I think isn’t needed. I could be very wrong though. In hind sight, comparing the search results I now see that my first query returns a list of group members, but the correct query returns all user details if the user is a member of the given group.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class="">So how am I meant to set the filter of ext_ldap_group_acl?<br class=""></blockquote><br class="">FYI, what the Squid helpers do is replace the %g and %u values and pass the resulting string as the 'filter' to LDAP.<br class=""><br class="">Meaning that the filter used by Squid should be the same as the ldapsearch filter would be if you were searching for username "%u" in group "%g".<br class=""></div></div></blockquote><div><br class=""></div><div>Thank you! This plus a little more Googling has yielded the following search string and ldap_group config which works (even for nested groups):</div><div><br class=""></div><div><div><font face="Courier New" class="">## IPA groups via LDAP</font></div><div><font face="Courier New" class="">external_acl_type ldap_group %LOGIN /usr/lib/squid/ext_ldap_group_acl -d \</font></div><div><font face="Courier New" class=""> -b "cn=users,cn=accounts,dc=DOMAIN,dc=COM" \</font></div><div><font face="Courier New" class=""> -D "uid=squid-ldap,cn=sysaccounts,cn=etc,dc=DOMAIN,dc=COM" \</font></div><div><font face="Courier New" class=""> -W "/etc/squid/squid-ldap.cred" \</font></div><div><font face="Courier New" class=""> -f "(&(objectclass=person)(uid=%u)(memberOf=cn=%g,cn=groups,cn=accounts,dc=DOMAIN,dc=COM))" \</font></div><div><font face="Courier New" class=""> -H <a href="LDAPS://ipa.domain.com:636" class="">LDAPS://ipa.domain.com:636</a></font></div><div class=""><br class=""></div><div class="">I also found that the credentials file I’m using had the wrong permissions. It hadn’t shown up earlier as anonymous bind was enabled previously. Interesting that logging when using `-d` on the auth plugins only gets put into cache.log and not the Journal.</div><div class=""><br class=""></div></div></div>-- <br class=""><div class="">Thank you,</div><div class="">Djerk</div></body></html>