there is only one "problem" left. when i change a ldap group and the user reauthenticats imediateli the old state is kept. when i reload squid the new state is used imediately. i think that because of some kind of caching of the credential. i's not a real problem, as i know what to do to "work it around". as i think, that caching the credentials is a good feature to reduce ldap traffic, i'm any way curious for how long they are cached an if i chan change the timeout.
--On Sunday, April 04, 2004 02:02:03 +0200 Henrik Nordstrom <[EMAIL PROTECTED]> wrote:
| On Sat, 3 Apr 2004 [EMAIL PROTECTED] wrote: | | > the relevant parts of my squid.conf look like this: | > | > ---- | > auth_param basic program /usr/lib/squid/ldap_auth -b | > ou=people,dc=mhcsoftware,dc=de localhost | > auth_param basic children 5 | > auth_param basic realm Squid proxy-caching web server | > auth_param basic credentialsttl 2 hours | | Needed. This defines authentication.
ok, so i was right. :-)
| > external_acl_type ldap %LOGIN /usr/lib/squid/squid_ldap_group | > -b "ou=groups,dc=mhcsoftware,dc=de" | > -f "(&(memberUid=%v)(cn=%a)(objectClass=posixGroup))" | > -B "ou=people,dc=mhcsoftware,dc=de" | > -F "(uid=%s)" | | Needed. This defines how Squid is to evaluate LDAP group based | authorization (not authentication). But the arguments does not match your | squid_ldap_auth. | | As you are not using a user filter in squid_ldap_auth you should not do | so in squid_ldap_group either.. just make the exact group membership | filter matchign groups where the login name is member. Most likely you | should just drop the user filter (and basedn) arguments here but it | depends on what your group objects look like. I would recommend playing | a little with ldapsearch. | | Note: You are using a very old and obsolete group filter syntax. The | current versions of the squid_ldap_group helper uses %g and %u for group | and user respectively (but still understands the older %a %v codes).
done - it now looks like this:
external_acl_type ldap %LOGIN /usr/lib/squid/squid_ldap_group -b "ou=groups,dc=mhcsoftware,dc=de" -f "(&(memberUid=%u)(cn=%g)(objectClass=posixGroup))"
and it works as expected !!
| > acl ldapauth proxy_auth REQUIRED | | This is only needed if you really want to base access controls on "all | authenticated users".
thats what i want
| > acl ldapGauth external ldap squid | | Normally this one is sufficient when using LDAP groups..
i will test this, but at my first test no u/p windows poped up at the browser with only that acl. but i can't remember if i alreaday activated ldap_auth at that time.
| > http_access allow ldapGauth | | Ok. | | > this seems to work, as i can do a correspoing ldapsearch without any | > problem. then it tries the goup lookup: | > | > Apr 3 15:50:30 server slapd[20926]: conn=32 op=1 SRCH | > base="ou=groups,dc=mhcsoftware,dc=de" scope=2 | > filter="(&(memberUid=uid=test,ou=people,dc=mhcsoftware,dc=de)(cn=squid) | > (obj ectClass=posixGroup))" | > | > and i think thats the problem. when i try this as a ldapsearch i get no | > result. but when i seach for: | > | > (&(memberUid=test)(cn=squid)(objectClass=posixGroup)) | | Ok, so you are not using normal LDAP groups but instead another form of | groups stored within LDAP... See above for the solution.
well, as i'm new to ldap i'm using <http://lam.sf.net/> and thats the way it creates groups. don't know why. i guess, "normal" LDAP group member entries look like this:
memberUid=uid=test,ou=people,dc=mhcsoftware,dc=de
and NOt olny like this:
memberUid=test
right ? and perhaps thats the better way, because with that users are identified with a (more or less) unique pattern. in larger environments "my" (better lam's) notification may be ambigous. i think, i start to understand ldap ...
| > i get the expected result. well and that filter is what i would expect | > when i look at my "squid_ldap_group" commandline. i do not understand | > why it users "memberUid=uid=test,ou=people,dc=mhcsoftware,dc=de" in | > sead of whats configured on the command line: "memberUid=test" | | This is done because you told squid_ldap_group to expand the login name | into the users DN via the group filter argument. See the squid_ldap_group | manual.
ah, i see ....
-f filter
LDAP search filter used to search the LDAP directory for any matching group memberships. Inthefilter%uwillbereplacedbytheuser loginname(or DN if the -F or -u options are used) and %g by the requested group name.
best regards and again: THANKS !!
--
Matthias Henze [EMAIL PROTECTED]
Use PGP!! http://www.mhcsoftware.de/MatthiasHenze.asc - - - - - - - - - - - - - - - - - - - - - - - - - - - - MHC SoftWare GmbH voice: +49-(0)9533-92006-0 Fichtera 17 fax: +49-(0)9533-92006-6 96274 Itzgrund/Germany e-Mail: [EMAIL PROTECTED] - - - - - - - - - - - - - - - - - - - - - - - - - - - -
