[squid-users] error: Could not get groups for user

Hello,

since a few days ago I am having some problems with users trying to
access Internet through proxy.

I have squid (2.5 stable 14) with user validation against an Active
Directory. I have a single domain and a sub-domain. Both have an
attribute
that marks users who have access granted to Internet: "Internet Default"
or "SUBDOMAIN\Internet Default".

User acces Control is defined in "squid.conf" this way:
        
        auth_param ntlm program /usr/bin/ntlm_auth
        --helper-protocol=squid-2.5-ntlmssp
        auth_param ntlm children 30
        auth_param basic children 5
        auth_param basic realm DOMAIN
        auth_param basic credentialsttl 2 hour
        
        external_acl_type wb_group ttl=900 %
        LOGIN /usr/lib/squid/wbinfo_group.pl
        
        acl ACCES_INTERNET external wb_group "/etc/squid/grupo-AD"

This is the content of my "/etc/squid/grupo-AD" file:
        "Internet Default"
        "SUBDOMAIN\Internet Default"

The problem is that users on the main domain have access to internet,
but some users on the subdomain don't. They are getting
ERR_ACCESS_DENIED error:

This is what is logged in "cache.log":
        Could not get groups for user SUBDOMAIN\\user1
        

If I run "usr/lib/squid/wbinfo_group.pl" via command line (assuming
user2 is working and user1 is not)

with params:
        SUBDOMAIN\user1 "\" SUBDOMAIN\\internet default\""
        Sending OK to squid
        
        SUBDOMAIN\user2 "\" SUBDOMAIN\\internet default\""
        Sending OK to squid

An the same but with two backslashes:
        SUBDOMAIN\\user1 "\" SUBDOMAIN\\internet default\""
        Could not get groups for user SUBDOMAIN\\user1
        Sending ERR to squid
        
        SUBDOMAIN\\user2 "\" SUBDOMAIN\\internet default\""
        Sending OK to squid
        

This is the content of the file "usr/lib/squid/wbinfo_group.pl":

> sub check {
> local($user, $group) = @_;
> $groupSID = `wbinfo -n "$group" | cut -d" " -f1`;
> chop $groupSID;
> $groupGID = `wbinfo -Y "$groupSID"`;
> chop $groupGID;
> &debug( "User: -$user-\nGroup: -$group-\nSID:
> -$groupSID-\nGID: -$groupGID-");
> return 'OK' if(`wbinfo -r \Q$user\E` =~ /^$groupGID$/m);
> return 'ERR';
> }
>
> #
> # Main loop
> #
> while (<STDIN>) {
> chop;
> &debug ("Got $_ from squid");
> if( $_ =~ /^"?([^"]+)"? / ) {
> $user = $1;
> }
> if( $_ =~ /(( "?\\"[^"]+\\""?)+)/i ) {
> $groups = $1;
> }
> s/"\\/\\/g for $groups;
> s/""/"/g for $groups;
> s/\\ / /g for $groups;
> $groups = substr($groups, 3, length($groups)-5);
> @groups = split /\\" \\"/, $groups;
> foreach $group(@groups) {
> $ans = &check($user, $group);
> last if($ans eq 'OK');
> }
> &debug ("Sending $ans to squid");
> print "$ans\n";
> }
>
        
Any help please?

Thank you so much

OS: Ubuntu 6.06
Squid 2.5 STABLE 14
LDAP: Active Directory (Windows 2003)
Received on Wed Nov 28 2007 - 05:12:54 MST