Changes between Version 21 and Version 22 of howto/SquidKerberosAuthentication

Timestamp:

01/12/11 15:29:26 (13 years ago)

Author:

Edwin Eefting

Comment:

--

howto/SquidKerberosAuthentication

@@ -30 +30 @@
  * Gewone standaard gebruiker: edwin, pass test
 
-== ldap gegevens bepalen ==
-
-Hiervoor gebruikt u de ldp.exe tool. Deze vind u in het 'Windows Support Tools' pakket van Microsoft. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en)
-
-In ons geval is de administrator DN:
- * CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl
 
 == Windows 7 client ==
@@ -129 +123 @@
 = Squid instellen =
 
+== ldap gegevens bepalen ==
+
+Om basic authentication te ondersteunen moet u de DN's uitzoeken op uw windows server. Deze kunt u gokken, of u gebruikt  de ldp.exe tool. Deze vind u in het 'Windows Support Tools' pakket van Microsoft. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en)
+
+In ons geval:
+ * Base DN: ''CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl''
+ * Administrator DN: ''CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl''
+
+== Keytab == 
+
 Squid moet bij de keytab file kunnen:
 {{{
@@ -135 +139 @@
 }}}
 
+== auth_param =
+
+Alle auth_param instellingen in /home/system/proxy/squid.conf vervangen:
+{{{
+# Kerberos authentication settings
+auth_param negotiate program /usr/bin/squid_kerb_auth -d 
+auth_param negotiate children 10
+auth_param negotiate keep_alive on
+
+# LDAP/AD settings, for clients that only support basic authentication:
+auth_param basic program /usr/bin/squid_ldap_auth -b "CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl" -s sub -D "CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl" -w as -f "(&(objectClass
+=person)(sAMAccountName=%s))" -u sAMAccountName -P -v 3 -h w2k3-edwin.adtest.psy.datux.nl
+auth_param basic children 10
+auth_param basic realm Proxy Authentication
+auth_param basic credentialsttl 2 hours
+}}}
+
+== acl en http_access ==
+
+Om tot slotte authenticatie in te schakellen en verplicht te stellen:
+Toevoegen op de juiste plekken in /home/system/proxy/squid.conf:
+{{{
+
+acl auth proxy_auth REQUIRED
+
+http_access allow auth
+
+}}}
 
 == Debugging ==