EXT_KERBEROS_SID_GROUP_ACL(8) User Contributed Perl Documentation EXT_KERBEROS_SID_GROUP_ACL(8)

ext_kerberos_sid_group_acl - external ACL helper for Squid to verify AD Domain group membership using sid.

ext_kerberos_sid_group_acl [-d] [-h] -p Principal Name -D Domain Controller -b Base DN -G Group1:Group2

ext_kerberos_sid_group_acl is an installed executable script. It uses ldapsearch from Openldap to lookup the name of a AD group sid.

This helper must be used in with the negotiate_kerberos_auth helper in a Microsft AD or Samba environement.

It reads from the standard input the domain username and a list of group sids and tries to match the group SIDs to the AD group sids.

Write debug info to stderr.
Print the help.
Principal name in squid keytab to use for ldap authentication to AD
Domain controller to contact to lookup group SID
Base DN for ldap search
AD group name to be used for SID lookup. List separated by a colon (:)

auth_param negotiate program /path/to/negotiate_wrapper_auth -d \
     --ntlm /path/to/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain example.com \
     --kerberos /path/to/negotiate_kerberos_auth -d -s GSS_C_NO_NAME -k /path/to/squid.keytab -t none
external_acl_type sid_check %LOGIN %note{group} /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2
acl squid_allow external sid_check
acl allowed_group external sid_check
http_access allow allowed_group

If the local perl interpreter is in a unusual location it may need to be added:

external_acl_type sid_check %LOGIN %note{group} /path/to/perl /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2

This program was written by Markus Moeller <markus_moeller@compuserve.com>

This manual was written by Markus Moeller <markus_moeller@compuserve.com>

* Copyright (C) 1996-2022 The Squid Software Foundation and contributors
*
* Squid software is distributed under GPLv2+ license and includes
* contributions from numerous individuals and organizations.
* Please see the COPYING and CONTRIBUTORS files for details.
This program is put in the public domain by Markus Moeller
<markus_moeller@compuserve.com>. It is distributed in the hope that it will
be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

Bug reports need to be made in English. See http://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using http://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

negotiate_kerberos_auth(8)

The Squid FAQ wiki http://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/

2022-12-12 perl v5.36.0