I want to get Squid running with Kerberos as default Logintype and all special cases handled by LDAP with Basic-Auth.
I tried several Configuration and approaches. This is what my configuration looks like at the moment:
auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -d -s HTTP/proxy.domain.ch@-.CH
auth_param negotiate children 10
auth_param negotiate keep_alive on
auth_param basic program /usr/lib/squid3/squid_ldap_auth -P -R -b "dc=-,dc=CH" -D "CN=proxyuser,CN=Users,DC=-,DC=CH" -w PW -f sAMAccountName=%s -u sAMAccountName -h DC:389
auth_param basic children 5
auth_param basic realm Proxy Authentifizierung
auth_param basic credentialsttl 5 minutes
external_acl_type ldapgroup %LOGIN /usr/lib/squid3/squid_ldap_group -d -K -P -R -b "dc=-,dc=CH" -D "CN=proxyuser,CN=Users,DC=-,DC=CH" -w PW -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,CN=Users,DC=-, DC=CH))" -h DC:389
### ACL alles
#acl all src all
### ACL Proxy Auth
acl AD-AUTH proxy_auth REQUIRED
### ACL Externe Gruppenabfrage AD_GRP_PROXY_FULL aus AD
acl ACL_AD_GRP_PROXY_FULL external ldapgroup Proxygroups
acl localdomain dstdomain .internal.ch
acl localservnet src 172.16.0.0/16
acl localnet src 172.18.0.0/16
### Verbiete Restricted_URL’s ohne Gruppenmitgliedschaft
#http_access deny AD-Auth !ACL_AD_GRP_PROXY_FULL
### Erlaube Restricted_URL’s bei Gruppenmitgliedschaft
http_access allow AD-Auth ACL_AD_GRP_PROXY_FULL
http_access allow AD-Auth
always_direct deny all
always_direct allow localservnet
always_direct allow localdomain
always_direct allow localnet
never_direct allow all
cache_peer PROXY parent 8080 8080 no-query no-digest no-netdb-exchange default
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access deny manager
http_access deny all
icp_access deny all
http_port 3128
I suspect the configuration parameters are not in the correct row or something, but I sort of tried a lot of things without getting them to work.
So what works:
LDAP User Query-Command Works LDAP Group Query-Command Works Kerberos seems to work (no errors in the logs anymore) (Kerberos keytab is valid and working)
Current behaviour is like this: people can access and use the proxy but have to enter LDAP information. When looking at the logs kerberos auth is clearly happening but somehow not enough for authorizing the user.
