ext_edirectory_userip_acl(8)

Usage

ext_edirectory_userip_acl [{-h | --help | --usage}]

ext_edirectory_userip_acl -H host -p port [-Z] [-P] [-v LDAP version] -b basedn -s scope -D binddn -W bindpass -F filter [-G]

Overview

ext_edirectory_userip_acl is an installed binary.

This program has been written in order to solve the problems associated with running the Perl squid_ip_lookup.pl as a squid external helper.

The limitations of the Perl script involved memory/cpu utilization, speed, the lack of eDirectory 8.8 support, and IPv6 support.

Options

-4: Force Addresses to be in IPv4 (0.0.0.0 format).

-6: Force Addresses to be in IPv6 (:: format).

-b base: Specify base DN. For example; o=ORG

-d: Write debug info to stderr.

-Dbinddn: Specify binding DN. For example; cn=squid,o=ORG

-F filter: Specify LDAP search filter. For example; (objectClass=User)

-G: Specify if LDAP search group is required. For example; groupMembership=

-h | --help | --usage: Display the binary help and command line syntax info using stderr.

-H host: Specify hostname or IP of server

-p port: Port number.

-P: Use persistent connections.

-t seconds: Timeout factor for persistent connections. Set to 0 for never timeout. Default is 60 seconds.

-s base|one|sub: search scope. Defaults to sub

: base object only,

: one level below the base object or

: subtree below the base object

-u attribute: Set userid attribute . Default is cn

-v 1|2|3: Set LDAP version

-V: Display version information and exit.

-W password: Specify binding password

-Z: Enable TLS security.

Configuration

external_acl_type IPUser %SRC /usr/sbin/ext_edirectory_userip_acl
acl edirectory_users_allowed external IPUser cn=Internet_Allowed,ou=ORG,o=BASE acl edirectory_users_denied external IPUser cn=Internet_Denied,ou=ORG,o=BASE
http_access deny edirectory_users_denied http_access allow edirectory_users_allowed http_access deny all

In this example, the Internet_Allowed and Internet_Denied are Groups that users may be used to control internet access, which can also be stacked against other ACL's. Use of the groups is optional, unless the '-G' option has been passed. Please note that you need to specify the full LDAP object for this, as shown above.

Known issues

IPv6 support has yet to be tested in a real IPv6 environment, but the code is in place to read IPv6 networkAddress fields, please attempt this in a TESTING environment first. Please contact the author regarding IPv6 support development.

There is a known issue regarding Novell's Client for Windows, that is mostly fixed by using version 4.91 SP3+, with the 'Auto-Reconnect' feature not re-populating the networkAddress field in eDirectory.

I have also experienced an issue related to using NetWare 6.5 (SP6 and lower?) and connection licensing. It appears that whenever a server runs low on connection licenses, that it I sometimes does not populate the networkAddress fields correctly.

Majority of Proxy Authentication issues can be resolved by having the users' reboot if their networkAddress is not correct, or using basic_ldap_auth as a fallback. Check ConsoleOne, etc to verify their networkAddress fields to troubleshoot.

Questions

Questions on the usage of this program can be sent to the Squid Users mailing list <[email protected]>