<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dear Squid Support Team,</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am currently configuring Squid with <b>Kerberos authentication</b> and would like to integrate
<b>Active Directory (AD) group-based access control</b>. My Kerberos authentication is working, and I can access AD successfully from my Ubuntu server. Below is my current Squid configuration:</div>
<pre style="background-color: rgb(255, 255, 255);"><div style="direction: ltr; text-align: left; text-indent: 0px; white-space: pre-wrap; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><code># Kerberos authentication
auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth
auth_param negotiate children 10
auth_param negotiate keep_alive on
# ACL's
acl kerberos-auth proxy_auth REQUIRED
http_access allow kerberos-auth
# General access
http_access allow localhost
http_access deny all
# Proxy settings
http_port 3128
cache_dir ufs /var/spool/squid 100 16 256
coredump_dir /var/spool/squid
</code></div></pre>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>What Works:</b></div>
<ol start="1" style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kerberos authentication is successfully validating users, and authenticated requests are being allowed through the proxy.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My Ubuntu server is connected to AD, and I can query AD successfully using <code>
ldapsearch</code>.</li></ol>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>What I Need Assistance With:</b></div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I want to integrate <b>AD group-based ACLs</b> to control user access based on their group membership in Active Directory. Specifically:</div>
<ol start="1" style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Restrict access for users in certain groups (e.g., <code>Blocked</code> group).</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Allow limited or filtered access for users in other groups (e.g., <code>Restricted</code> or
<code>Filtered</code> groups).</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Provide full internet access for users in a <code>FullAccess</code> group.</li></ol>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Questions:</b></div>
<ol start="1" style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
What is the best way to combine Kerberos authentication with AD group-based access control in Squid?</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Should I use the <code>external_acl_type</code> helper with LDAP queries, or is there a better way, such as leveraging
<code>note</code> ACLs and group annotations from the Kerberos helper?</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Are there specific configuration examples or optimizations you recommend to achieve this setup?</li></ol>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Additional Information:</b></div>
<ul style="text-align: left; background-color: rgb(255, 255, 255);">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am new to configuring Squid and AD integration and have very little experience with these systems. If possible, I would greatly appreciate clear and beginner-friendly guidance.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have tested <code>ldapsearch</code> and confirmed that I can retrieve user attributes, including
<code>memberof</code>, from AD.</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Despite extensive searching online, I couldn’t find a complete configuration example for integrating Kerberos authentication and AD group-based ACLs. If such an example exists, could you share it or guide me in creating one?</li></ul>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you in advance for your assistance. Please let me know if additional details or logs are needed.</div>
<div style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); margin: 1em 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>