Solved.
Assuming the following:
- Domain name: "domain.com"
- Group name: "Internet Users"
- User name: "UserName"
- Path to group: "domain.com\OU1\OU2\Internet Users"
The query for checking if the user is member of that group would be:
(&(memberOf=CN=Group Name,OU=OU2,OU=OU1,DC=domain,DC=com)(SAMAccountName=UserName))
So you would have to add the following to squidGuard.conf to identify the members of that group ("%s" is squidGuard.conf's placeholder for "the client's user name"):
src Internet_Users {
ldapusersearch ldap://dc.domain.com/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet Users,OU=OU2,OU=OU1,DC=domain,DC=com))
}
Caveat: it will not work if written as above, giving you a laconic "syntax error" message; this is because (part of) the statement is treated like a URL, so you have to escape special characters such as commas and whitespaces; the correct form would thus be this one:
src Internet_Users {
ldapusersearch ldap://dc.domain.com/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet%20Users%2cOU=OU2%2cOU=OU1%2cDC=domain%2cDC=com))
}
Also, in order to avoid problems with Active Directory referrals (sometimes a DC will just redirect you to another one, even if you are on the same domain it manages), it might be useful to query a global catalog:
src Internet_Users {
ldapusersearch ldap://gc.domain.com:3268/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet%20Users%2cOU=OU2%2cOU=OU1%2cDC=domain%2cDC=com))
}
LDAP SSO expects mod_auth_sspi to set the REMOTE_USER server variable with the name of the authenticated user, but apparently it's not doing that.
The mod_auth_sspi wiki says you should add
JkEnvVar REMOTE_USER
to your mod_jk configuration. You could put it anywhere in your Apache configuration. Then reload Apache.
Best Answer
Web Filtering On Squid 3 With QuintoLabs Content Security 1.4 And Windows Active Directory Integration
This way you get SSO on Squid with Kerberos and extensive web filtering with qlproxy as ICAP server.