2

Just installed pfsense and squid on a spare machine. I am trying to get Squid to authenticate AD users via LDAP.

First I tried this: http://vicryhc.wordpress.com/2013/07/08/how-to-setting-squid-on-pfsense-with-authentiaction-ldap-windows/

My domain name is ads.example.local I have created a user "squid" in Users container in AD.

  • LDAP server user DN: cn=squid,cn=Users,dc=ads,dc=example,dc=local
  • LDAP password: mypassword
  • LDAP base domain: dc=ads,dc=example,dc=local
  • LDAP username DN attribute: uid
  • LDAP search filter: (sAMAccountName=%s)

To my dismay it didn't work; so I experimented a bit and changed the base domain:

LDAP base domain: **cn=Users,**dc=ads,dc=example,dc=local

And bingo! It worked. However, this setup is meant to authenticate just one user - "squid" which is in Users container in my AD.

So I continued further with same guide which also shows how to authenticate a group of users.

I created a group named "InternetUsers" in the "Users" container in AD and added some users to it.

I then changed the settings:

  • LDAP server user DN: cn=squid,cn=Users,dc=ads,dc=example,dc=local
  • LDAP password: mypassword
  • LDAP base domain: dc=ads,dc=example,dc=local
  • LDAP username DN attribute: uid

As per the guide, I entered following value for LDAP search filter:

(&(memberOf=CN=InternetUsers,CN=Users,DC=ads,DC=example,DC=local)(sAMAccountName=%s))

This couldn't authenticate any user. So I experimented a bit with it... Also tried LDAP base domain: cn=Users,dc=ads,dc=example,dc=local

But no luck whatsoever. Squid log entries show "Operational error" - nothing specific.

So something is wrong with either my LDAP search filter or the base domain value.

Any suggestions to correct my mistake? Or any LDAP analyzer tool which I can install on AD server that can help me debug my settings?

Thanks in advance.

Update:

The "InternetUsers" group is a security group which is in Users container in AD. I added all my users to this group. These users are spread across AD in various OUs.

Three of these users - "squid", "test", and "administrator" are in Users container and I am able to verify them using these values:

LDAP base domain: cn=Users,dc=ads,dc=example,dc=local
(Doesn't work if I set base domain to dc=ads,dc=example,dc=local)
LDAP username DN attribute: samAccountName
LDAP search filter:(&(memberOf=CN=InternetUsers,CN=Users,DC=ads,DC=example,DC=local)(sAMAccountName=%s))

But users which reside in other OUs cannot be authenticated even if they are members of InternetUsers group. The search is not recursive and won't go beyond one level it seems. So either I have to find a way to incorporate multiple base domain values or edit some configuration file manually to make it recursive.

| improve this question | |
2

In the LDAP username DN attribute change it to something that exists in your AD database. In general the uid attribute is left empty, except in cases where the Sysadmins cares about UNIX attributes stored in the AD base.

Just change it for the sAMAccountName and test if it will work.

| improve this answer | |
  • I will give it a try. But if that was the case, the "squid" user wouldn't have been authenticated...? – Golmaal May 29 '14 at 6:44
  • 1
    Nope, you defined the SQUID authentication in the beginning, in the LDAP User. That user is used to search the LDAP. – Vinícius Ferrão May 29 '14 at 7:29
  • I got your point. I realized that now the problem I have to solve is how to specify multiple base domains and combine multiple search filters using OR. You answered helped a lot. – Golmaal May 29 '14 at 8:45
  • The base domains are at the same Domain Controllers? – Vinícius Ferrão May 29 '14 at 16:01
  • Yes there is only one domain controller. I have created security group InternetUsers and placed it in Users container. It contains all my users. With that I am able to verify users which are in Users container but users in other containers (OU) cannot be verified. The search is not recursive (one level only) and thus unless I manually edit the configuration, the task seems impossible. I am updating the question with latest info. – Golmaal May 29 '14 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.