[squid-users] squid_ldap_group troubles

Hello guys,

I'd like use LDAP groups to setup access right for users.

Current configuration:

===

auth_param basic program /usr/local/libexec/squid/squid_ldap_auth \
  -b "ou=Users,dc=home" -v 3 localhost
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

external_acl_type ldap_group %LOGIN /usr/local/libexec/squid/squid_ldap_group \
  -b "ou=Groups,dc=home" -f "(&(memberUid=%u)(cn=%g))" -v 3 localhost \
  -D "cn=Guest,ou=DSA,dc=home" -w xxx

[skipped]

acl CONNECT method CONNECT
acl ldap_unlim external ldap_group squid-unlim

[skipped]

http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access allow ldap_unlim
http_access deny all

===

LDAP group:

$ ldapsearch -LLL -s sub -b "ou=Groups,dc=home" -D "cn=Guest,ou=DSA,dc=home" -w xxx "(&(memberUid=sak)(cn=squid-unlim))"
dn: cn=squid-unlim,ou=Groups,dc=home
objectClass: top
objectClass: posixGroup
cn: squid-unlim
gidNumber: 2001
memberUid: sak

squid_ldap_group looks working:

# /usr/local/libexec/squid/squid_ldap_group -h 127.0.0.1 -b "ou=Groups,dc=home" -f "(&(memberUid=%u)(cn=%g))" -D "cn=Guest,ou=DSA,dc=home" -w xxx -v 3 -d
sak squid-unlim
Connected OK
group filter '(&(memberUid=sak)(cn=squid-unlim))', searchbase 'ou=Groups,dc=home'
OK

but when I try access Internet site, I get:

The following error was encountered:

Access Denied.
Access control configuration prevents your request from being allowed
at this time. Please contact your service provider if you feel this is
incorrect.

In slapd.log:

May 1 14:00:28 pixel slapd[744]: conn=255 fd=21 ACCEPT from IP=127.0.0.1:51366 (IP=127.0.0.1:389)
May 1 14:00:28 pixel slapd[744]: conn=255 op=0 BIND dn="uid=sak,ou=Users,dc=home" method=128
May 1 14:00:28 pixel slapd[744]: conn=255 op=0 BIND dn="uid=sak,ou=Users,dc=home" mech=SIMPLE ssf=0
May 1 14:00:28 pixel slapd[744]: conn=255 op=0 RESULT tag=97 err=0 text=
May 1 14:00:28 pixel slapd[744]: conn=255 op=1 UNBIND
May 1 14:00:28 pixel slapd[744]: conn=255 fd=21 closed
May 1 14:00:28 pixel slapd[744]: conn=256 fd=21 ACCEPT from IP=127.0.0.1:50849 (IP=127.0.0.1:389)
May 1 14:00:28 pixel slapd[744]: conn=256 op=0 SRCH base="ou=Groups,dc=home" scope=2 deref=0 filter="(&(memberUid=sak)(cn=squid-unlim))"
May 1 14:00:28 pixel slapd[744]: conn=256 op=0 SRCH attr=1.1
May 1 14:00:28 pixel slapd[744]: conn=256 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text=
May 1 14:00:28 pixel slapd[744]: conn=256 op=1 UNBIND
May 1 14:00:28 pixel slapd[744]: conn=256 fd=21 closed

# squid -v
Squid Cache: Version 2.6.STABLE12

Where am I wrong?

Thanks for any help.

-- 
Best regards,
 Sergey                          mailto:ksa@uaic.net