Re: [squid-users] Re: Re: Re: Re: Re: Re: Re: Re: squid_ldap_group against nested groups/Ous

From: Eugene M. Zheganin <>
Date: Mon, 06 Aug 2012 18:07:33 +0600


On 06.08.2012 16:48, Markus Moeller wrote:
> Hi Eugene,
> How would a squid_group_ldap line look like ? From where would the
> group name come from ? I could try to add this feature.

That would be awesome.

squid_group_ldap is expecting to see the username along with the group
name to check the membership in on it's stdin. It looks the same way
your helper works, just with a group name. In the same time, in a config
file you could describe the group directly, or supply a filename which
contains the group name (I prefer a filename, for example).

My squid.conf prior to using squid_kerb_ldap helper used to look like:

external_acl_type ldap_group ttl=60 negative_ttl=60
children=40 %LOGIN \
/usr/local/libexec/squid/squid_ldap_group \
                                         -b cn=Users,dc=norma,dc=com \
"(&(cn=%g)(member=%u)(objectClass=group))" \
                                         -F "sAMAccountname=%s" \
cn=dca,cn=Users,dc=norma,dc=com \
/usr/local/etc/squid/ad.passwd -h -v 3 -p 389

acl ad-internet-users external ldap_group
acl ad-privileged external ldap_group
acl ad-icq-only external ldap_group
acl ad-no-icq external ldap_group
acl kontur-clients external ldap_group
acl ad-no-pictures external ldap_group
acl ad-personnel-only external ldap_group
acl ad-mdm external ldap_group
acl ad-sber external ldap_group
acl ad-e5 external ldap_group
acl ad-raiffeisen external ldap_group

Received on Mon Aug 06 2012 - 12:07:43 MDT

This archive was generated by hypermail 2.2.0 : Mon Aug 06 2012 - 12:00:03 MDT