Re: [squid-users] Squid for windows authentication against Active Directory

On 25/05/11 20:42, Julian Zoellner wrote:
> hello Amos,
>
>> Please use 2.7.STABLE9 at the very least. 2.7 as a whole is aging and
>> deprecated, we support 2.7.STABLE9 only until all its useful features
>> are ported to 3.x series.
>
> we already use 2.7.STABLE8 and i can't find a STABLE9 download for windows.
>
> i updated the squid.conf file to:
>
> auth_param ntlm program c:/squid/libexec/mswin_ntlm_auth.exe -d
> auth_param ntlm children 5
>
> external_acl_type win_domain_group ttl=120 %LOGIN c:/squid/libexec/mswin_check_ad_group.exe -d -G
> acl Inet external win_domain_group MY-DOMAIN/Groups/Internet
>
> acl loggedIn proxy_auth REQUIRED
> http_access allow loggedIn Inet
>
>
> This setup ask for username and password in my Browser and nothing is right (the same for just the NTLM authentication), maybe no communication in the network? also i don't want to login while starting the browser, it should look in the given group that the user is in.
>

The group cannot be known until the user is received from the browser.
If the browser is showing a popup that means it cannot find any username
available to it or the ones it has have failed to validate as correct
with the DC. All of this is inside the client machine, outside of Squids
control.

Despite popular belief Squid does not generate a popup. All Squid does
is ask the browser for credentials (*any* credentials) of an acceptable
type.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.12
   Beta testers wanted for 3.2.0.7 and 3.1.12.1