Transparent Edirectory Authentication

[Guest]

[martman22]

Hi,

Here are some instructions for setting up transparent edirectory authentication with Endian 2.4. It seems to work well and content filtering and the other options are still selectable and function. I was not able to get LDAP ssl working for this, but since the transparent check does not need passwords it may not be needed. Also since I am not a perl or cgi programmer by trade I did not enable multiple edirectory groups. If you are a programmer and can make those few changes for selecting groups it would be appreciated.

It would be great if the endian team would consider adding this authentication type as a standard feature in a future release.

Note:  This add-on allows users logged into an edirectory server to access the http proxy without a login prompt.

!!Update:   Updated instructions for secure authentication and also tips on redundancy for auth and proxy server using dns.

[mrkroket]

Very very interesting, thanks. ¿Is there some setup to do the same with Active Directory?

[martman22]

Looks like you already have that in NTLM AD authentication.

[mrkroket]

It's not the same. I've been testing with non-transparent proxy, and it's more problematic than transparent one.
Although it correctly filter out https, I have problems with some programs and some services.

[martman22]

I hope we are not confusing transparent proxy with transparent authentication where a user does not need to login per say. This will only work with a non-transparent proxy as far as I know. This add-on feature is the latter. Sorry for the confusion.

[martman22]

A  quick modifications.
Corrected the squid template file to fix a problem with the antivirus not linking with the transparent proxy. I also shortened the fall back authentication to a single line in squid conf.

[martman22]

This mod should also work with version 2.4.1 - follow the directions with the following exception: make the script change to proxypolicy.cgi instead of proxyconfig.cgi.

[whoiam55]

Nice one, thanks you very much

[martman22]

FYI. 
For eDir=> 8.8 on Linux Suse server change the following line in squid_edir_iplookup.pl :

$netaddress="1\#";

to

$netaddress=sprintf("9\#%c%c",0,0);

[martman22]

Here is an update to the squid helper app that will work with both types of edirectory servers. Change the name of this script to the same as in your squid.conf before using. And of course modify it with your correct edirectory parameters.