Just installed pfsense and squid on a spare machine. I am trying to get Squid to authenticate AD users via LDAP.
First I tried this: http://vicryhc.wordpress.com/2013/07/08/how-to-setting-squid-on-pfsense-with-authentiaction-ldap-windows/
My domain name is ads.example.local I have created a user "squid" in Users container in AD.
- LDAP server user DN:
cn=squid,cn=Users,dc=ads,dc=example,dc=local
- LDAP password:
mypassword
- LDAP base domain:
dc=ads,dc=example,dc=local
- LDAP username DN attribute:
uid
- LDAP search filter:
(sAMAccountName=%s)
To my dismay it didn't work; so I experimented a bit and changed the base domain:
LDAP base domain: **cn=Users,**dc=ads,dc=example,dc=local
And bingo! It worked. However, this setup is meant to authenticate just one user - "squid" which is in Users container in my AD.
So I continued further with same guide which also shows how to authenticate a group of users.
I created a group named "InternetUsers" in the "Users" container in AD and added some users to it.
I then changed the settings:
- LDAP server user DN:
cn=squid,cn=Users,dc=ads,dc=example,dc=local
- LDAP password:
mypassword
- LDAP base domain:
dc=ads,dc=example,dc=local
- LDAP username DN attribute:
uid
As per the guide, I entered following value for LDAP search filter:
(&(memberOf=CN=InternetUsers,CN=Users,DC=ads,DC=example,DC=local)(sAMAccountName=%s))
This couldn't authenticate any user. So I experimented a bit with it...
Also tried LDAP base domain: cn=Users,dc=ads,dc=example,dc=local
But no luck whatsoever. Squid log entries show "Operational error" - nothing specific.
So something is wrong with either my LDAP search filter or the base domain value.
Any suggestions to correct my mistake? Or any LDAP analyzer tool which I can install on AD server that can help me debug my settings?
Thanks in advance.
Update:
The "InternetUsers" group is a security group which is in Users container in AD. I added all my users to this group. These users are spread across AD in various OUs.
Three of these users - "squid", "test", and "administrator" are in Users container and I am able to verify them using these values:
LDAP base domain: cn=Users,dc=ads,dc=example,dc=local
(Doesn't work if I set base domain to dc=ads,dc=example,dc=local)
LDAP username DN attribute: samAccountName
LDAP search filter:(&(memberOf=CN=InternetUsers,CN=Users,DC=ads,DC=example,DC=local)(sAMAccountName=%s))
But users which reside in other OUs cannot be authenticated even if they are members of InternetUsers group. The search is not recursive and won't go beyond one level it seems. So either I have to find a way to incorporate multiple base domain values or edit some configuration file manually to make it recursive.