<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dear Squid Support Team,</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am currently configuring Squid to use <b>Kerberos authentication</b> with <b>Active Directory (AD) group-based access control</b>, but I am encountering an issue where the ACLs for AD groups are not being applied correctly. Below are the details of my setup
and the challenges I am facing:</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Setup Details:</b></div>
<ol start="1" style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>Kerberos:</b></div>
</li><ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kerberos authentication is working successfully.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The service principal and keytab are correctly configured, and the <code>kinit</code> command works as expected.</li></ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>LDAP:</b></div>
</li><ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
LDAP connectivity is functional. I can successfully query the Active Directory using
<code>ldapsearch</code>:
<pre><div style="white-space: pre-wrap; margin: 0px;"><button style="margin:0px" class="x_flex x_gap-1 x_items-center x_select-none x_py-1"><div style="white-space: pre-wrap; margin: 0px;"></div></button></div><div style="direction: ltr; white-space: pre-wrap; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;"><code>ldapsearch -x -H ldap://172.16.10.254 -D "CN=Administrator,CN=Users,DC=demo,DC=local" -w Passw0rd -b "DC=demo,DC=local" "(sAMAccountName=jon.jones)"
</code></div></pre>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The output includes the correct <code>memberof</code> attributes showing the user's group memberships.</li></ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>Squid Configuration:</b><br>
I have configured Squid for LDAP group-based access control as follows:</div>
<pre><div style="white-space: pre-wrap; margin: 0px;"><button style="margin:0px" class="x_flex x_gap-1 x_items-center x_select-none x_py-1"><div style="white-space: pre-wrap; margin: 0px;"></div></button></div><div style="direction: ltr; white-space: pre-wrap; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;"><code>external_acl_type ldap_group %LOGIN /usr/lib/squid/ext_ldap_group_acl -R \
-b "DC=demo,DC=local" \
-D "CN=Administrator,CN=Users,DC=demo,DC=local" \
-w Passw0rd \
-f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,CN=Users,DC=demo,DC=local))" \
-h 172.16.10.254
acl FullAccess external ldap_group FullAccess
acl Restricted external ldap_group Restricted
acl Filtered external ldap_group Filtered
acl Blocked external ldap_group Blocked
http_access deny Blocked
http_access allow FullAccess
http_access allow Restricted allowed_sites
http_access deny Restricted
http_access deny Filtered bad_sites
http_access allow Filtered
http_access deny all
</code></div></pre>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>What Works:</b></div>
</li><ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kerberos authentication is functioning as expected.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The <code>ext_ldap_group_acl</code> utility works correctly when tested manually:
<pre><div style="white-space: pre-wrap; margin: 0px;"><button style="margin:0px" class="x_flex x_gap-1 x_items-center x_select-none x_py-1"><div style="white-space: pre-wrap; margin: 0px;"></div></button></div><div style="direction: ltr; white-space: pre-wrap; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;"><code>echo "jon.jones FullAccess" | /usr/lib/squid/ext_ldap_group_acl -R \
-b "DC=demo,DC=local" \
-D "CN=Administrator,CN=Users,DC=demo,DC=local" \
-w Passw0rd \
-f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,CN=Users,DC=demo,DC=local))" \
-h 172.16.10.254
</code></div></pre>
The output returns <code>OK</code>, indicating that the LDAP group membership is correctly validated.</li></ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>The Problem:</b></div>
</li><ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When users authenticate via Kerberos, the Squid ACLs based on AD groups are not being matched.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
All users fall into the default <code>http_access deny all</code> rule, even if they belong to a permitted AD group.</li></ul>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 1em 0px;"><b>Log Example:</b><br>
In the <code>cache.log</code> file, I see the following entries:</div>
<pre><div style="direction: ltr; white-space: pre-wrap; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;"><code>WARNING: external_acl_type 'ldap_group' queue overload
...
Checklist.cc answer DENIED for match
...
setAuth: WARNING: Graceful closure on conn due to connection-auth erase from ConnStateData::SwanSong cleanup
</code></div></pre>
</li></ol>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Request for Assistance:</b></div>
<ul style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
How can I ensure that Squid properly applies AD group-based ACLs when users authenticate via Kerberos?</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Are there specific configurations or known limitations for combining Kerberos authentication with LDAP group validation in Squid?</li></ul>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I would greatly appreciate any guidance or suggestions to resolve this issue. If additional logs or details are needed, please let me know.</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for your support!</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,<br>
Enfal gok</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>