Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.

--===============1508596921701039083==
Content-Type: multipart/alternative; boundary="0000000000008789d2064c1d87ab"

--0000000000008789d2064c1d87ab
Content-Type: text/plain; charset="UTF-8"

Hello,

I use negotiate_kerberos_auth helper and it sets the AD groups list in a
group annotation attribute.
It works well, but this attribute is not available in the subsequent
requests in an ssl-bumped connection (it is available only in the first
CONNECT request).
Is it possible to make this attribute persistent in the current SSL
connection? I would like to use groups from this attribute to authorize
users using only "note"-type ACLs, no external helpers involved.
Kind regards,
Ankor.

--0000000000008789d2064c1d87ab
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,=C2=A0<div><br></div><div>I use=C2=A0negotiate_kerbe=
ros_auth helper and it sets the AD groups list in a group annotation attrib=
ute.</div><div><span style=3D"white-space-collapse: preserve;">It works wel=
l, but </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-spa=
ce-collapse: preserve;">this</span><span style=3D"white-space-collapse: pre=
serve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-s=
pace-collapse: preserve;">attribute</span><span style=3D"white-space-collap=
se: preserve;"> is not </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" st=
yle=3D"white-space-collapse: preserve;">available</span><span style=3D"whit=
e-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9" style=3D"white-space-collapse: preserve;">in</span><span style=3D"whit=
e-space-collapse: preserve;"> the </span><span class=3D"gmail-YPkS7KbdpWfGd=
YKd3QB9" style=3D"white-space-collapse: preserve;">subsequent</span><span s=
tyle=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7=
KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">requests</span><=
span style=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail=
-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">in</span><=
span style=3D"white-space-collapse: preserve;"> an </span><span class=3D"gm=
ail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">ssl</sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">-</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"wh=
ite-space-collapse: preserve;">bumped</span><span style=3D"white-space-coll=
apse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=
=3D"white-space-collapse: preserve;">connection (it is available only in th=
e first CONNECT request)</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" s=
tyle=3D"white-space-collapse: preserve;">.</span></div><div><span class=3D"=
gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">Is it=
 <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">possible</span> <span class=3D"=
gmail-YPkS7KbdpWfGdYKd3QB9">to</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd=
3QB9">make</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">this</span> <s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">attribute</span> persistent <span =
class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">in</span> the <span class=3D"gmail-YPk=
S7KbdpWfGdYKd3QB9">current</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9=
">SSL</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">connection</span><s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">?</span>

<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">I</span> <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">would</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"=
>like</span> to <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">use</span> <span=
 class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">groups</span> <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">from</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">=
this</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">attribute</span> <sp=
an class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">to</span> <span class=3D"gmail-YPkS=
7KbdpWfGdYKd3QB9">authorize</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB=
9">users</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">using</span> onl=
y &quot;note&quot;-type <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">ACLs</sp=
an>, no external helpers involved.
<br></span></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"w=
hite-space-collapse: preserve;">Kind regards,</span></div><div><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"> =
   Ankor.


</span></div></div>

--0000000000008789d2064c1d87ab--

--===============1508596921701039083==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============1508596921701039083==--