squid_ldap_auth(8)

NAME
squid_ldap_auth - Squid LDAP authentication helper

SYNOPSIS
squid_ldap_auth [options] ldap_server_name

DESCRIPTION
This helper allows Squid to connect to a LDAP directory to validate the user name and password of Basic HTTP authentication.

-b basedn (REQUIRED)
    Specifies the base DN under which the users are located.

-f filter
    LDAP search filter to locate the user DN. Required if the users are in a hierarchy below the base DN, or if the login name is not what builds the user specific part of the users DN.

    The search filter can contain up to 15 occurrences of %s which will be replaced by the username, as in "uid=%s" for RFC2037 directories.

-u userattr
    The name of the DN attribute which makes the username. Defaults to RFC2307 standard "uid". Some LDAP directories uses "cn" instead of "uid" (for example Microsoft Active Directory).

    This is used to directly construct a user DN when the -f search option is not used.

-s base|one|sub
    search scope when performing user DN searches specified by the -f option.

    base object only, one level below the base object or subtree below the base object

-D binddn -w password
    The DN and password to bind as while performing searches. Required by the -f flag if the directory does not allow anonymous searches.

    As the password needs to be printed in plain text in your Squid configuration it is strongly recommended to use a account with minimal associated privileges. This to limit the damage in case someone could get hold of a copy of your Squid configuration file.

-p  Use a persistent LDAP connection. Normally the LDAP connection is only open while validating a username to preserve resources at the LDAP server. This option causes the LDAP connection to be kept open, allowing it to be reused for further user validations. Recommended for larger installations.

-R  do not follow referrals

-a never|always|search|find
    when to dereference aliases

    never dereference aliases (default), always dereference aliases, only while searching or only to find the base object

EXAMPLES
For directories using the RFC2307 layout with a single domain, all you need to specify is usually the base DN under where your users are located, and the server name.

    squid_ldap_auth -b ou=people,dc=your,dc=domain ldapserver

If you have sub-domains then you need to use a search filter to locate the users

    squid_ldap_auth -b dc=your,dc=domain -f uid=%s ldapserver

Or if the user attribute of the user DN is "cn" instead of "uid" and you do not want to have to search for the users then you could use something like the following example for Active Directory:

    squid_ldap_auth -u cn -b cn=Users,dc=your,dc=domain ldapserver

If you want to search for the user DN and your directory does not allow anonymous searches then you must also use the -D and -w flags to specify a user DN and password to log in as to perform the searches, as in the following complex Active Directory example

    squid_ldap_auth -p -R -b dc=your,dc=domain -D cn=squid,cn=users,dc=your,dc=domain -w secretsquidpassword -f userPrincipalName=%s activedirectoryserver

AUTHOR
This manual page was written by Henrik Nordstrom <hno@squid-cache.org>

squid_ldap_auth is written by Glenn Newton <gnewton@wapiti.cisti.nrc.ca> and Henrik Nordstrom <hno@squid-cache.org>

KNOWN ISSUES
Will crash if other % values than %s is used in -f, or if more than 15 %s is used.

QUESTIONS
Any questions on usage can be sent to Squid Users <squid-users@squid-cache.org>, or to your favorite LDAP list/friend if the question is more related to LDAP than Squid.

REPORTING BUGS
Report bugs or bug-fixes to Squid Developers <squid-dev@squid-cache.org>