.TH squid_ldap_group 8 "30 January 2005" "Version 2.17"..SH NAMEsquid_ldap_group - Squid LDAP external acl group helper..SH SYNOPSISsquid_ldap_group -b "base DN" -f "LDAP search filter" [options] [ldap_server_name[:port]|URI].....SH DESCRIPTIONThis helper allows Squid to connect to a LDAP directory toauthorize users via LDAP groups.LDAP options are specified as parameters on the command line,while the username(s) and group(s) to be checked against theLDAP directory are specified on subsequent lines of input to thehelper, one username/group pair per line separated by a space..PAs expected by the external_acl construct of Squid, afterspecifying a username and group followed by a new line, thishelper will produce either OK or ERR on the following lineto show if the user is a member of the specified group..PThe program operates by searching with a search filter basedon the users user name and requested group, and if a matchis found it is determined that the user belongs to the group...TP.BI "-b " "basedn " (REQUIRED)Specifies the base DN under which the groups are located...TP.BI "-B " "basedn "Specifies the base DN under which the users are located (if different)..TP.B "-g"Specifies that the first query argument sent to the helper by Squid isa extension to the basedn and will be temporarily added in front of theglobal basedn for this query...TP.BI "-f " filterLDAP search filter used to search the LDAP directory for anymatching group memberships..BRIn the filter %u will be replaced by the user name (or DN ifthe -F or -u options are used) and %g by the requested group name...TP.BI "-F " filterLDAP search filter used to search the LDAP directory for anymatching users..BRIn the filter %s will be replaced by the user name. If % is to beincluded literally in the filter then use %%...TP.BI "-u " attrLDAP attribute used to construct the user DN from the user name andbase dn without needing to search for the user...TP.BI "-s " base|one|subsearch scope. Defaults to 'sub'..IP.B baseobject only,.B onelevel below the base object or.BR sub treebelow the base object..TP.BI "-D " "binddn " "-w " passwordThe DN and password to bind as while performing searches. Requiredif the directory does not allow anonymous searches..IPAs the password needs to be printed in plain text in your Squid configurationand will be sent on the command line to the helper it is strongly recommendedto use a account with minimal associated privileges.  This to limit the damagein case someone could get hold of a copy of your Squid configuration file orextracts the password used from a process listing...TP.BI "-D " "binddn " "-W " "secretfile "The DN and the name of a file containing the passwordto bind as while performing searches. .IPLess insecure version of the former parameter pair with two advantages:The password does not occur in the process listing, and the password is not being compromised if someone gets the squid configuration file without getting the secretfile...TP.BI -PUse a persistent LDAP connection. Normally the LDAP connectionis only open while verifying a users group membership to preserveresources at the LDAP server. This option causes the LDAP connection tobe kept open, allowing it to be reused for further uservalidations. Recommended for larger installations...TP.BI -Rdo not follow referrals..TP.BI "-a " never|always|search|findwhen to dereference aliases. Defaults to 'never'.IP.BI neverdereference aliases (default),.BI alwaysdereference aliases, only while.BR search ingor only to.B findthe base object..TP.BI -H " ldapuri"Specity the LDAP server to connect to by a LDAP URI (requires OpenLDAP libraries)..TP.BI -h " ldapserver"Specify the LDAP server to connect to.TP.BI -p " ldapport"Specify an alternate TCP port where the ldap server is listening ifother than the default LDAP port 389...TP.BI -v " 2|3"LDAP protocol version. Defaults to 2 if not specified...TP.BI -ZUse TLS encryption..TP.BI -E certpathEnable LDAP over SSL (requires Netscape LDAP API libraries)..TP.BI -c connect_timeoutSpecify timeout used when connecting to LDAP servers (requiresNetscape LDAP API libraries).TP.BI -t search_timeoutSpecify time limit on LDAP search operations..TP.BI -SStrip NT domain name component from user names (/ or \\ separated)..TP.BI -dDebug mode where each step taken will get reported in detail.Useful for understanding what goes wrong if the results isnot what is expected..SH SQUID CONFIGURATION.This helper is intended to be used as a external_acl_type helper fromsquid.conf..P.ft CR.nfexternal_acl_type ldap_group %LOGIN /path/to/squid_ldap_group ....bracl group1 external ldap_group Group1.bracl group2 external ldap_group Group2.fi.ft..SH NOTES.When constructing search filters it is recommended to first test the filterusing ldapsearch before you attempt to use squid_ldap_group. This to verifythat the filter matches what you expect...SH AUTHORThis manual page was written by .I Henrik Nordstrom <hno@marasystems.com>.Psquid_ldap_group is written by .I Flavio Pescuma <flavio@marasystems.com>and.IR "Henrik Nordstrom <hno@squid-cache.org>" ,based on prior work in squid_ldap_auth by.I Glen Newton <glen.newton@nrc.ca>..SH KNOWN LIMITATIONSMax 16 occurrences of %s in the -u argument is supported...SH QUESTIONSAny questions on usage can be sent to .IR "Squid Users <squid-users@squid-cache.org>" ,or to your favorite LDAP list/friend if the question is more related toLDAP than Squid...SH REPORTING BUGSReport bugs or bug-fixes to.I Squid Bugs <squid-bugs@squid-cache.org>or ideas for new improvements to .I Squid Developers <squid-dev@squid-cache.org>..SH "SEE ALSO".BR squid_ldap_auth ( 8 ),.BR ldapsearch ( 1 ),.brYour favorite LDAP documentation.br.BR RFC2254 " - The String Representation of LDAP Search Filters,"