Re: helper protocol in 3.4

Hi Amos,

   I have a very new update to the negotiate helper which should make it unnecessary to do any ldap group lookups for MS Active Directory environments. It would require the new protocol and I would appreciate if you coule dlet me know how to read the kv pairs in an external ACL helper I still need to write.

   As you may know MS adds SIDS of the groups to a Kerberos ticket. I can now extract these groups as a base 64 encoded string, which just need to be compared with in the external ACL helper.

  Here is an example debug output:

negotiate_kerberos_pac.cc(358): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Got PAC data of lengh 512
negotiate_kerberos_pac.cc(177): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Found 5 rids
negotiate_kerberos_pac.cc(184): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: Info: Got rid: 513
negotiate_kerberos_pac.cc(184): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: Info: Got rid: 1132
negotiate_kerberos_pac.cc(184): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: Info: Got rid: 1141
negotiate_kerberos_pac.cc(184): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: Info: Got rid: 1207
negotiate_kerberos_pac.cc(184): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: Info: Got rid: 1142
negotiate_kerberos_pac.cc(247): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Got DomainLogonId S-1-5-21-1828870822-1098772068-2592627279
negotiate_kerberos_pac.cc(268): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Found 1 ExtraSIDs
negotiate_kerberos_pac.cc(316): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Got ExtraSid S-1-5-21-1828870822-1098772068-2592627279-1107
negotiate_kerberos_pac.cc(438): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: INFO: Read 512 of 512 bytes
negotiate_kerberos_auth.cc(431): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: DEBUG: Groups group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiaAQIAAA== group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiabAQAAA== group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiadQQAAA== group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiatwQAAA== group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiadgQAAA== group=AQUAAAAAAAUVAAAAploCbWTufUFPWoiaUwQAAAAAAAA=
AF oRQwEqADCgEAoQsGCSqGSIb3EgECAg== mm_at_WIN2003R2.HOME
negotiate_kerberos_auth.cc(436): pid=8653 :2013/08/23 12:39:26| negotiate_kerberos_auth: DEBUG: AF oRQwEqADCgEAoQsGCSqGSIb3EgECAg== mm_at_WIN2003R2.HOME

As you can see I create a list of base64 encoded SIDS ( I have attached also some code to convert it if you want to)

e.g. ./convert_sid AQUAAAAAAAUVAAAAploCbWTufUFPWoiadgQAAA==
argc: 2 argv: AQUAAAAAAAUVAAAAploCbWTufUFPWoiadgQAAA==
S-1-5-21-1828870822-1098772068--1702340017-1142

To configure an external ACL helper a Adminstrator need to list the groups(MS only adds Security groups to the ticket afaik) of a user. As example my mm id has:

ldapsearch -H ldap://w2k3r2.win2003r2.home:389 -s sub -b DC=WIN2003R2,DC=HOME "(samaccountname=mm)" memberof
SASL/GSSAPI authentication started
SASL username: mm_at_WIN2003R2.HOME
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <DC=WIN2003R2,DC=HOME> with scope subtree
# filter: (samaccountname=mm)
# requesting: memberof
#

# Markus Moeller, HomeUsers, win2003r2.home
dn: CN=Markus Moeller,OU=HomeUsers,DC=win2003r2,DC=home
memberOf:: Q0490L/QtdGB0L3RjyxPVT1Hcm91cHMsREM9d2luMjAwM3IyLERDPWhvbWU=
memberOf: CN=Group2,OU=Groups,DC=win2003r2,DC=home
memberOf: CN=Group1,OU=Groups,DC=win2003r2,DC=home
memberOf: CN=Administrators,CN=Builtin,DC=win2003r2,DC=home

# search reference
ref: ldap://ForestDnsZones.win2003r2.home/DC=ForestDnsZones,DC=win2003r2,DC=ho
 me

# search reference
ref: ldap://DomainDnsZones.win2003r2.home/DC=DomainDnsZones,DC=win2003r2,DC=ho
 me

# search reference
ref: ldap://win2003r2.home/CN=Configuration,DC=win2003r2,DC=home

# search result
search: 5
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

For example the objectsid ( This is what is in the kerberos ticket) is also base63 encoded in ldap (this is my I choose to use the encoded form to make the helper a cut and paste exercise)

ldapsearch -H ldap://w2k3r2.win2003r2.home:389 -s sub -b DC=WIN2003R2,DC=HOME "(cn=Group2)" objectsid
SASL/GSSAPI authentication started
SASL username: mm_at_WIN2003R2.HOME
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <DC=WIN2003R2,DC=HOME> with scope subtree
# filter: (cn=Group2)
# requesting: objectsid
#

# Group2, Groups, win2003r2.home
dn: CN=Group2,OU=Groups,DC=win2003r2,DC=home
objectSid:: AQUAAAAAAAUVAAAAploCbWTufUFPWoiadgQAAA==

# search reference
ref: ldap://ForestDnsZones.win2003r2.home/DC=ForestDnsZones,DC=win2003r2,DC=ho
 me

# search reference
ref: ldap://DomainDnsZones.win2003r2.home/DC=DomainDnsZones,DC=win2003r2,DC=ho
 me

# search reference
ref: ldap://win2003r2.home/CN=Configuration,DC=win2003r2,DC=home

# search result
search: 5
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

I would appreciate any feedback , comments, improvements.

Thank you
Markus

BTW the patch also contains a fix for peer_proxy_negotiate_auth as it did not comole anymore with the latest heimdal libraries.

"Markus Moeller" <huaraz_at_moeller.plus.com> wrote in message news:kuq8i8$1oa$1_at_ger.gmane.org...
> Hi Amos,
>
> I may have a helper for that case soon.
>
> Thank you
> Markus
>
> "Amos Jeffries" <squid3_at_treenet.co.nz> wrote in message
> news:52106190.2030403_at_treenet.co.nz...
>> On 18/08/2013 9:32 a.m., Markus Moeller wrote:
>>> Hi,
>>>
>>> I am look at a way to provide information in addition to the username
>>> from the auth helper to the external acl helper
>>>
>>> Can I use kv pairs in squid 3.4 ? I see there is a kv pair group= . Does
>>> it mean the auth helper can return details which will be used by the
>>> external acl helper ?
>>>
>>> Thank you
>>> Markus
>>>
>>
>> Yes kv-pairs are supported in 3.4.
>>
>> I reserved group= so the auth helper can do exactly that. For usage in
>> either external ACL helpers, or in a "group" type ACL. However, at present
>> the internal parts of Squid do not exist to do anything with it.
>> The planned definition is to have helpers return one "group=" kv-pair for
>> each group the auth helper can identify and attach them as annotation data
>> to the credentials pair.
>>
>> Amos
>>
>>
>
>
>