Re: [squid-users] block domains based on LDAP group and force re-authentication every 30 minutes

Op 21-feb.-2014, om 10:39 heeft FredB <fredbmail_at_free.fr> het volgende geschreven:

>
>> I now have implemented FredB’s idea into my own basic helper in php,
>> which says ERR when the credential expire date time is in the past.
>> That seems to work also for iPads :)
>> That expire date time can be set (to now + xx min) via a php page and
>> correct credentials.
>>
>
> Can you post your helper somewhere ? What about performance with many users ?
>
> Fred

No idea about performance yet…

I’ve set up a web server on the proxy which checks credentials with an external db or ldap and if correct fills the mysql db for the helper (fields: username password expirationdatetime), the helper code is below. For now i just check all entries of a username and password, but removing the record when it is expired is a to-do item, then the foreach can be replaced by a single check.

<?php
$f = fopen("php://stdin", "r");
while ($line = fgets($f)) {
        $line = trim($line);
        $fields = explode(' ', $line);
    
if(isset($fields[1])){

        $user = rawurldecode($fields[0]);
        $pass = rawurldecode($fields[1]);
$dsn = 'mysql:host=localhost;dbname=mydb';
$username = 'usr';
$password = 'pass';
$options = array(
    PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8',
);

$dbh = new PDO($dsn, $username, $password, $options);
$stmt = $dbh->prepare('SELECT * from authorizedclients WHERE usr=:usr AND pwd=:pwd');
#$stmt = $dbh->prepare('SELECT * from authorizedclients');
$stmt->bindParam(':usr', $user);
$stmt->bindParam(':pwd', $pass);
$stmt->execute();
$results = $stmt->fetchAll();

$res=false;
foreach($results as $row) {
        if(new DateTime($row['expires-after'])> new DateTime())
        {
                fwrite(STDOUT, "OK\n");
                $res = true;
        }
}
if(!$res){fwrite(STDOUT, "ERR\n");}
    
}
else
{
fwrite(STDOUT, "ERR\n");
}
}
?>
Received on Fri Feb 21 2014 - 09:53:46 MST