Ldap – Where is “Custom Attribute 14” in AD Schema

The pedant in me is forced to point out that what you're creating here is not a schema, but a layout. A schema defines objects-types and attributes on the objects, a layout defines where the objects are and what values are assigned to the attributes.

That out of the way...

When you add people you'll be associating them with the OrganizationalRoles you're defining, and people can belong to many of them. In fact, where their object actually resides doesn't confer any rights; it's the act of associating an OR with them. When they bind, they'll gain the rights of the ORs they're a member of, regardless of where their object is.

To answer your question of figuring out what rights they get, they should be listed in two places:

• On their user-object
• On the organizationalRole object

You'd form the LDAP query to pull either the orMember attribute from the user object, or query all organizationalRole objects with a member of the user. The exact name of the attribute on the user depends on your actual LDAP schema in use.

I got this to work in my environment by querying LDAP for the userPrincipalName instead of sAMAccountName as my squid also returns user@domain.local from Kerberos/NTLM auth.

Also be sure to use %20 instead of spaces and when I was specifying the bind DN in my conf file, I used quotes as it had an & in the DN and squidguard was not binding because of it.