Changes between Version 21 and Version 22 of howto/SquidKerberosAuthentication


Ignore:
Timestamp:
01/12/11 15:29:26 (14 years ago)
Author:
Edwin Eefting
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • howto/SquidKerberosAuthentication

    v21 v22  
    3030 * Gewone standaard gebruiker: edwin, pass test
    3131
    32 == ldap gegevens bepalen ==
    33 
    34 Hiervoor gebruikt u de ldp.exe tool. Deze vind u in het 'Windows Support Tools' pakket van Microsoft. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en)
    35 
    36 In ons geval is de administrator DN:
    37  * CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl
    3832
    3933== Windows 7 client ==
     
    129123= Squid instellen =
    130124
     125== ldap gegevens bepalen ==
     126
     127Om basic authentication te ondersteunen moet u de DN's uitzoeken op uw windows server. Deze kunt u gokken, of u gebruikt  de ldp.exe tool. Deze vind u in het 'Windows Support Tools' pakket van Microsoft. (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en)
     128
     129In ons geval:
     130 * Base DN: ''CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl''
     131 * Administrator DN: ''CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl''
     132
     133== Keytab ==
     134
    131135Squid moet bij de keytab file kunnen:
    132136{{{
     
    135139}}}
    136140
     141== auth_param =
     142
     143Alle auth_param instellingen in /home/system/proxy/squid.conf vervangen:
     144{{{
     145# Kerberos authentication settings
     146auth_param negotiate program /usr/bin/squid_kerb_auth -d
     147auth_param negotiate children 10
     148auth_param negotiate keep_alive on
     149
     150# LDAP/AD settings, for clients that only support basic authentication:
     151auth_param basic program /usr/bin/squid_ldap_auth -b "CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl" -s sub -D "CN=Administrator,CN=Users,DC=adtest,DC=psy,DC=datux,DC=nl" -w as -f "(&(objectClass
     152=person)(sAMAccountName=%s))" -u sAMAccountName -P -v 3 -h w2k3-edwin.adtest.psy.datux.nl
     153auth_param basic children 10
     154auth_param basic realm Proxy Authentication
     155auth_param basic credentialsttl 2 hours
     156}}}
     157
     158== acl en http_access ==
     159
     160Om tot slotte authenticatie in te schakellen en verplicht te stellen:
     161Toevoegen op de juiste plekken in /home/system/proxy/squid.conf:
     162{{{
     163
     164acl auth proxy_auth REQUIRED
     165
     166http_access allow auth
     167
     168}}}
    137169
    138170== Debugging ==