👤
Home Man
Search
Today's Posts
Register

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:
Select Section of Man Page:
Select Man Page Repository:

RedHat 9 (Linux i386) - man page for squid_ldap_auth (redhat section 8)

squid_ldap_auth(8)							       squid_ldap_auth(8)

NAME
       squid_ldap_auth - Squid LDAP authentication helper

SYNOPSIS
       squid_ldap_auth -b "base DN" [-u attribute] [options] [ldap_server_name[:port]]...]

       squid_ldap_auth	   -b	  "base     DN"     -f	  "LDAP    search    filter"	[options]
       [ldap_server_name[:port]...]

DESCRIPTION
       This helper allows Squid to connect to a LDAP directory to  validate  the  user	name  and
       password of Basic HTTP authentication.

       The  program  has two major modes of operation. In the default mode of operation the users
       DN is constructed using the base DN and user attribute. In the other mode of  operation	a
       search filter is used to locate valid user DN's below the base DN.

       -b basedn (REQUIRED)
	      Specifies the base DN under which the users are located.

       -f filter
	      LDAP  search filter to locate the user DN. Required if the users are in a hierarchy
	      below the base DN, or if the login name is not what builds the user  specific  part
	      of the users DN.

	      The  search filter can contain up to 15 occurrences of %s which will be replaced by
	      the username, as in "uid=%s" for RFC2037 directories. For a detailed description of
	      LDAP search filter syntax see RFC2254.

       -u userattr
	      Specifies  the name of the DN attribute that contains the username/login.  Combined
	      with the base DN to construct the users DN when no search filter is  specified  (-f
	      option). Defaults to 'uid'

	      Note:  This  can only be done if all your users are located directly under the same
	      position in the LDAP tree and the login name is used for naming each  user  object.
	      If  your	LDAP tree does not match these criterias or if you want to filter who are
	      valid users then you need to use a search filter to search for your  users  DN  (-f
	      option).

       -s base|one|sub
	      search  scope when performing user DN searches specified by the -f option. Defaults
	      to 'sub'.

	      base object only, one level below the base object or subtree below the base object

       -D binddn -w password
	      The DN and password to bind as while performing searches. Required by the  -f  flag
	      if the directory does not allow anonymous searches.

	      As the password needs to be printed in plain text in your Squid configuration it is
	      strongly recommended to use a account with minimal associated privileges.  This  to
	      limit  the damage in case someone could get hold of a copy of your Squid configura-
	      tion file.

       -P     Use a persistent LDAP connection. Normally the LDAP connection is only  open  while
	      validating  a username to preserve resources at the LDAP server. This option causes
	      the LDAP connection to be kept open, allowing it to be reused for further user val-
	      idations. Recommended for larger installations.

       -R     do not follow referrals

       -a never|always|search|find
	      when to dereference aliases. Defaults to 'never'

	      never dereference aliases (default), always dereference aliases, only while search-
	      ing or only to find the base object

       -h ldapserver
	      Specify the LDAP server to connect to

       -p ldapport
	      Specify an alternate TCP port where the ldap server is listening if other than  the
	      default LDAP port 389.

EXAMPLES
       For  directories using the RFC2307 layout with a single domain, all you need to specify is
       usually the base DN under where your users are located and the server name:

	      squid_ldap_auth -b ou=people,dc=your,dc=domain ldapserver

       If you have sub-domains then you need to use a search filter approach to locate your  user
       DNs as these can no longer be constructed direcly from the base DN and login name alone:

	      squid_ldap_auth -b dc=your,dc=domain -f uid=%s ldapserver

       And similarily if you only want to allow access to users having a specific attribute

	      squid_ldap_auth	-b   dc=your,dc=domain	 -f   (&(uid=%s)(specialattribute=value))
	      ldapserver

       Or if the user attribute of the user DN is "cn" instead of "uid" and you do  not  want  to
       have  to  search for the users then you could use something like the following example for
       Active Directory:

	      squid_ldap_auth -u cn -b cn=Users,dc=your,dc=domain ldapserver

       If you want to search for the user DN and your directory does not allow anonymous searches
       then  you must also use the -D and -w flags to specify a user DN and password to log in as
       to perform the searches, as in the following complex Active Directory example

	      squid_ldap_auth -p -R -b dc=your,dc=domain  -D  cn=squid,cn=users,dc=your,dc=domain
	      -w  secretsquidpassword  -f (&(userPrincipalName=%s)(objectClass=Person)) activedi-
	      rectoryserver

NOTES
       When constructing search filters it is strongly	recommended  to  test  the  filter  using
       ldapsearch  before  you	attempt  to  use  squid_ldap_auth. This to verify that the filter
       matches what you expect.

AUTHOR
       This manual page was written by Henrik Nordstrom <hno@squid-cache.org>

       squid_ldap_auth is written by Glenn Newton <gnewton@wapiti.cisti.nrc.ca> and Henrik  Nord-
       strom <hno@squid-cache.org>

KNOWN ISSUES
       Will crash if other % values than %s is used in -f, or if more than 15 %s is used.

QUESTIONS
       Any  questions  on  usage  can be sent to Squid Users <squid-users@squid-cache.org>, or to
       your favorite LDAP list/friend if the question is more related to LDAP than Squid.

REPORTING BUGS
       Report bugs or bug-fixes to Squid  Bugs	<squid-bugs@squid-cache.org>  or  ideas  for  new
       improvements to Squid Developers <squid-dev@squid-cache.org>

SEE ALSO
       ldapsearch(1),
       Your favorite LDAP documentation
       RFC2254 - The String Representation of LDAP Search Filters,

Squid LDAP Auth 			25 September 2001		       squid_ldap_auth(8)


All times are GMT -4. The time now is 02:01 PM.

Unix & Linux Forums Content Copyrightę1993-2018. All Rights Reserved.
×
UNIX.COM Login
Username:
Password:  
Show Password