8 thoughts on “HOW To: Squid AD Authentication”

1. 

   Thanks for the great page. The instructions were great. I got everything to run, except squid. When I try to run squid, I receive the following error:
   2009/01/28 11:37:05| Ready to serve requests.
   2009/01/28 11:37:05| helperStatefulHandleRead: unexpected read from ntlmauthenticator #3, 28 bytes ‘NT_STATUS_OK: Success (0x0)
   ‘
   2009/01/28 11:37:05| StatefulHandleRead: no callback data registered
   2009/01/28 11:37:05| helperStatefulHandleRead: unexpected read from ntlmauthenticator #1, 28 bytes ‘NT_STATUS_OK: Success (0x0)
   ‘
   2009/01/28 11:37:05| StatefulHandleRead: no callback data registered
   2009/01/28 11:37:05| helperStatefulHandleRead: unexpected read from ntlmauthenticator #2, 28 bytes ‘NT_STATUS_OK: Success (0x0)
   ‘
   2009/01/28 11:37:05| StatefulHandleRead: no callback data registered
   2009/01/28 11:37:05| WARNING: ntlmauthenticator #3 (FD 8) exited
   2009/01/28 11:37:05| WARNING: ntlmauthenticator #1 (FD 6) exited
   2009/01/28 11:37:05| WARNING: ntlmauthenticator #2 (FD 7) exited
   2009/01/28 11:37:05| Too few ntlmauthenticator processes are running
   FATAL: The ntlmauthenticator helpers are crashing too rapidly, need help!

   anyone else have this?

   Posted by mark | 2009/01/28, 4:53 pm
   Reply to this comment
2. 

   Hmm,
   I will look into this ASAP.
   Can you post your copy of /usr/lib/squid/wbinfo_group_H.pl?
   Regards,
   H

   Posted by admin | 2009/01/28, 5:16 pm
   Reply to this comment
3. 

   #!/usr/bin/perl -w
   #
   # external_acl helper to Squid to verify NT Domain group
   # membership using wbinfo
   #
   # This program is put in the public domain by Jerry Murdock
   # . It is distributed in the hope that it will
   # be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
   # of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   #
   # Author:
   # Jerry Murdock
   #
   # Version history:
   # 2005-12-26 Guido Serassio
   # Add ‘-d’ command line debugging option
   #
   # 2005-12-24 Guido Serassio
   # Fix for wbinfo from Samba 3.0.21
   #
   # 2004-08-15 Henrik Nordstrom
   # Helper protocol changed to URL escaped in Squid-3.0
   #
   # 2005-06-28 Arno Streuli
   # Add multi group check
   #
   # 2002-07-05 Jerry Murdock
   # Initial release

   #
   # Globals
   #
   use vars qw/ %opt /;

   # Disable output buffering
   # $|=1; remmed out by me

   $|=1;sub debug {
   print STDERR “@_\n” if $opt{d};
   }

   #
   # Check if a user belongs to a group
   #
   sub check {
   local($user, $group) = @_;
   $groupSID = `wbinfo -n “$group” | cut -d” ” -f1`;
   chop $groupSID;
   $groupGID = `wbinfo -Y “$groupSID”`;
   chop $groupGID;
   &debug( “User: -$user-\nGroup: -$group-\nSID: -$groupSID-\nGID: -$groupGID-“);
   return ‘OK’ if(`wbinfo -r \Q$user\E` =~ /^$groupGID$/m);
   return ‘ERR’;
   }

   #
   # Command line options processing
   #
   sub init()
   {
   use Getopt::Std;
   my $opt_string = ‘hd’;
   getopts( “$opt_string”, \%opt ) or usage();
   usage() if $opt{h};
   }

   #
   # Message about this program and how to use it
   #
   sub usage()
   {
   print “Usage: wbinfo_group.pl -dh\n”;
   print “\t-d enable debugging\n”;
   print “\t-h print the help\n”;
   exit;
   }

   init();
   print STDERR “Debugging mode ON.\n” if $opt{d};

   #
   # Main loop
   #
   while () {
   chop;
   &debug (“Got $_ from squid”);
   ($user, @groups) = split(/\s+/);
   $user =~ s/%([0-9a-fA-F][0-9a-fA-F])/pack(“c”,hex($1))/eg;
   # test for each group squid send in it’s request
   $thegroup = “”;
   foreach $group (@groups) {
   if (length($thegroup) ==0){
   $thegroup=$group;
   } else {
   $thegroup = $thegroup . ” ” . $group;
   }
   }
   $group = $thegroup;
   $group =~ s/%([0-9a-fA-F][0-9a-fA-F])/pack(“c”,hex($1))/eg;
   $ans = &check($user, $group);
   &debug (“Sending $ans to squid”);
   print “$ans\n”;
   }

   Posted by mark | 2009/01/28, 6:20 pm
   Reply to this comment
4. 

   I got past the above error, but I am prompted for a username and password. When i try it won’t let me in, and gives me a cache access denied error. If after the auth_param ntlm program /usr/bin/ntlm_auth –helper-protocol=squid-2.5-ntlmssp, I put –diagnostics –username=user –password=password –domain=domain. It will let only this user logon and no one else.

   Posted by Mark | 2009/01/29, 8:40 pm
   Reply to this comment
5. 

   In my cache log I am see this:

   Could not lookup name myusername mygroupname
   Could not convert sid to gid
   Could not get groups for user 0
   Could not lookup name myusername mygroupname
   Could not convert sid to gid
   Could not get groups for user 0

   Posted by Mark | 2009/01/29, 10:54 pm
   Reply to this comment
6. 

   Sorry for the delay.
   Please see the more recent posting “Squid AD”.
   try running:
   wbinfo_group_H.pl -d

   At the prompt type:
   YOURDOMAIN\userid YOURDOMAIN\accessgrp

   Replacing:
   YOURDOMAIN with the short name of your AD domain
   userid with a user login that is in “accessgrp”:
   accessgrp with a group that contains your users whom will be granted access.
   [CTRL] C to exit.

   Regards,
   –H

   Posted by admin | 2009/03/23, 3:06 pm
   Reply to this comment
7. 

   I m a Regular Visitir of your Blog, I like your Blog due to Quality of your information, hope to see valuable information from you in future, i am much inpired from your blog

   Posted by exbar | 2010/09/02, 10:36 am
   Reply to this comment
8. 

   Thanks for the feedback.
   Alas this particular entry is smi abandoned as I haven’t the time to update it.
   Alas my employer has almost abandoned the open source format. We are using RHEL for our Linux installations but all the Windows networking is now entirely AD and Windows Servers.

   Having said that I can’t blam them as we really struggled to stablise Samba.

   Posted by admin | 2010/09/02, 12:03 pm
   Reply to this comment