Mostly Software Engineering » SQUID http://www.advansen.com Gabriel Gonzalez's notebook Thu, 22 Jul 2010 13:47:36 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 SQUID + Active Directory http://www.advansen.com/2009/09/21/squid-active-directory/ http://www.advansen.com/2009/09/21/squid-active-directory/#comments Mon, 21 Sep 2009 10:59:54 +0000 Gabriel Gonzalez http://www.advansen.com/?p=114 A few post ago I wrote about integrating SQUID and Active Directory in order to allow/deny users to access specific webpages depeding on the groups a user belongs.

The windows package of Squid comes with several external programs which can be used as external ACLs which allow you to query the local Active Directory in order to obtain access or not. The one dealing with users and groups is called mswin_check_ad_group.exe which, as all the external ACLs, reads the standard input looking for a user and a group and return whether the user belongs to the given group.

This is fine and pretty straight forward it has a PROBLEM, it only works with Groups with scope set to “Domain Local”; which turn into a drawback when your users belong to Groups with Global Scope. I haven’t found any documentation explaining how to achive this so I have created a simple external ACL to peform this task in python.

You only need to download pywin32 and the active directory plugin for python. After installing just use the following code, which will return OK IFF the user belongs to the given group (non matter which scope):

  1.  
  2. import os, subprocess, sys, re
  3.  
  4. import active_directory
  5.  
  6. while (1) :
  7.  
  8.         squid = sys.stdin.readline()
  9.  
  10.         if len(squid) == 0:
  11.  
  12.                 break
  13.  
  14.         m = re.search(‘(?<=%5C)\w+’, squid);
  15.  
  16.         username = m.group(0)
  17.  
  18.         m = re.search(‘(?<= )[\w\.]+’, squid);
  19.  
  20.         checkgroup = m.group(0)
  21.  
  22.         ret = "ERR";
  23.  
  24.         user = active_directory.find_user(username);
  25.  
  26.         for group in user.memberOf:
  27.  
  28.                 if (cmp(group.cn, checkgroup)  == 0):
  29.  
  30.                         ret = "OK"
  31.                         break
  32.  
  33.         print   ret + "\r\n";
  34.  
  35.         sys.stdout.flush()
I am new to the Python world so, for sure, this little thing can be improved, feel free to comment anything.
]]> http://www.advansen.com/2009/09/21/squid-active-directory/feed/ 0