RE: [squid-users] SOS with squid_ldap_auth !!

What would be the right openldap version for the following combination:

RedHat 8.0 (2.4.18-14) and Squid 2.5.STABLE4-20031110. When compiling
Squid with enable ....ldap.... options how to specify an alternate
openldap location.

Do squid_ldap_auth and squid_ldap_group support Kerberos bind? How to
make Kreberos bind?

Thanks a lot,
Alex

-----Original Message-----
From: Henrik Nordstrom [mailto:hno@squid-cache.org]
Sent: Friday, January 13, 2006 6:14 PM
To: Meyerovich Aleksandr EB_NY
Cc: Squid Users
Subject: Re: [squid-users] SOS with squid_ldap_auth !!

On Fri, 13 Jan 2006, Meyerovich Aleksandr EB_NY wrote:

> Are there any debugging switches for squid_ldap_auth to get something
> more descriptive than ERR?

-d gives you some details. But there isn't much it can give. Most
operations is of "works/fails" nature mainly depending on getting the
configuration right.

There is only two configuration steps involved:

  1. The binddn needs to be correct. (-D -w options)

  2. The search filter needs to find/match the users correctly. (-b -f
options, and perhaps -R)

Most of the other options are not relevant in MSAD setups.

> - I can reach the MSAD LDAP server by short name as well as FQDN
> - squid_ldap_auth compiled with no problems:
> ldd squid_ldap_auth
> - I tried all example formats in the manual page with filters and
> without
> - tried cn attr as well as sAMAccountName
> - With -D and -w and without.

Have you got the search bind DN and password correct? Most MSAD setups
won't give you much information at all unless you first authenticate to
the AD.. On the nice side it seems you can use shortnames (i.e.
user@your.ad.domain) as the binddn.

If you are in doubt I recommend first exploring your MSAD with LDAP
tools.
It is a lot easier to understand what is required to get squid_ldap_auth

running smoothly if you first get normal LDAP tools working right...

Regards
Henrik
Received on Tue Jan 17 2006 - 11:08:39 MST