[squid-users] Re: Configuring Squid LDAP Authentication

I came across this configuration online, but it still doesn't work. I
really thought I would of had it on this one, but still not go.

acl lan src 192.168.1.0/25
acl Intranet dstdomain intranet.int
acl lan-intranet dst 192.168.2.2
http_access allow lan
http_access allow Intranet
http_access allow lan-intranet

On Wed, Jan 11, 2012 at 11:37 AM, berry guru <berryguru_at_gmail.com> wrote:
> I wanted to test something, but not quite sure how to do it. �I want
> to see if my Intranet users can authenticate when they go to
> 'companyname-intranet' and are prompted for a login. �When I enable
> the proxy I'm unable to login to the Intranet, but when I disable the
> proxy I can login. �So I'm thinking its an issue with Squid and I need
> to add something to Squid to allow authentication. �I'm I incorrect in
> this assessment? �If so, how do I go about allowing access to that
> site. �Do I do this via an ACL?
>
> On Wed, Jan 11, 2012 at 10:30 AM, berry guru <berryguru_at_gmail.com> wrote:
>> I used the following tutorial online to configure Squid to
>> authenticate with AD, but I still can't get this working. �As most
>> have seen, I also used a tutorial written by one of our mailing list
>> members and that didn't work. �Are others having this much trouble
>> getting Squid to authenticate with there Active Directory server? �So
>> frustrating!
>>
>> Configuring Squid LDAP Authentication
>>
>> The first step is to configure Squid to authenticate
>> usernames/passwords with the Active Directory. You will need to open
>> your Squid configuration file (squid.conf) and make the following
>> changes:
>>
>> Find the auth param section of the config file (TAG: auth_param), and
>> change the auth param basic program line to look like this. (Indented
>> text indicates one line)
>>
>> � �auth_param basic program /usr/lib/squid/ldap_auth -R
>> � � � �-b "dc=vm-domain,dc=papercut,dc=com"
>> � � � �-D "cn=Administrator,cn=Users,dc=your,dc=domain,dc=com"
>> � � � �-w "password" -f sAMAccountName=%s -h 192.168.1.75
>> � �auth_param basic children 5
>> � �auth_param basic realm Your Organisation Name
>> � �auth_param basic credentialsttl 5 minutes
>>
>> These settings tell Squid authenticate names/passwords in the Active Directory.
>>
>> � �The -b option indicated the LDAP base distinguished name of your
>> domain. E.g. your.domain.com would be dc=your,dc=domain,dc=com
>> � �The �D option indicates the user that is used to perform the LDAP
>> query. (e.g an Administrator. This example uses the built-in
>> Administrator user, however you can use another user of your choice.
>> � �The �w option is the password for the user specified in the �D
>> option. For better security you can store the password in a file and
>> use the �W /path/to/password_file syntax instead
>> � �-h is used to indicate the LDAP server to connect to. E.g. your
>> domain controller.
>> � �-R is needed to make Squid authenticate against Windows AD
>> � �The �f option is the LDAP query used to lookup the user. In the
>> above example, sAMAccountName=%s, will match if the user�s Windows
>> logon name matches the username entered when prompted by Squid. You
>> can search any value in the LDAP filter query. You may need to use an
>> LDAP search query tool to help get the syntax correct for the �f
>> search filter.
>> � �The %s is replaced with what the user enters as their username.
>>
>> Remember to restart Squid to make these changes to come into effect.
Received on Wed Jan 11 2012 - 23:28:02 MST