Re: Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.

--===============0774634225087077722==
Content-Type: multipart/alternative; boundary="0000000000007721e5064c2d012c"

--0000000000007721e5064c2d012c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello, Amos,

Thanks for the information.

Can you also tell me:
1. Is it possible to use a macro in the annotate_client ACL to copy HTTP
request notes to a TCP connection? Something like:
  acl annotate_groups annotate_client groups=3D%{group}note

2. How do you think, should we process the "group" attribute at the
connection state level as we do with the "clt_conn_tag"? I think this can
be easily implemented in the UpdateRequestNotes() function (
src/HttpRequest.cc) by simply copying and pasting a few lines of code:
void
UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs
const &helperNotes)
{
    // Tag client connection if the helper responded with clt_conn_tag=3Dta=
g
or group=3Dgroups.
    const char *cltTag =3D "clt_conn_tag";
    if (const char *connTag =3D helperNotes.findFirst(cltTag)) {
        if (csd) {
            csd->notes()->remove(cltTag);
            csd->notes()->add(cltTag, connTag);
        }
    }
    const char *group =3D "group";
    if (const char *hlprGroup =3D helperNotes.findFirst(group)) {
        if (csd) {
            csd->notes()->remove(group);
            csd->notes()->add(group, hlprGroup);
        }
    }
    request.notes()->replaceOrAdd(&helperNotes);
}

=D0=B2=D1=82, 3 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 16:02, Amos=
 Jeffries <[email protected]>:

> On 04/03/2026 01:06, Andrey K wrote:
> > Hello,
> >
> > I use negotiate_kerberos_auth helper and it sets the AD groups list in =
a
> > group annotation attribute.
> > It works well, but thisattributeis not availableinthe
> > subsequentrequestsinan ssl-bumpedconnection (it is available only in th=
e
> > first CONNECT request).
> > Is it possible to make this attribute persistent in the current SSL
> > connection? I would like to use groups from this attribute to authorize
> > users using only "note"-type ACLs, no external helpers involved.
>
> Unfortunately Squid does not yet support ACLs using details directly
> from the tunnel's "parent" CONNECT transaction.
>
> You can use the annotate_client ACL type to mark the from-client TCP
> connection instead of the HTTP request. Just be aware these need to be
> manually configured and thus does not scale to large number of groups.
>
> HTH
> Amos
>
> _______________________________________________
> squid-users mailing list
> [email protected]
> https://lists.squid-cache.org/listinfo/squid-users
>

--0000000000007721e5064c2d012c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello, Amos,<br><br>Thanks for the information.<br><br><sp=
an class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: pres=
erve;">Can</span><span style=3D"white-space-collapse: preserve;"> you </spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse:=
 preserve;">also</span><span style=3D"white-space-collapse: preserve;"> </s=
pan><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collaps=
e: preserve;">tell</span><span style=3D"white-space-collapse: preserve;"> m=
e</span>: <br>1. Is it possible to use a macro in the <font face=3D"monospa=
ce">annotate_client</font> ACL to copy HTTP request notes to a TCP connecti=
on? Something like:<br>=C2=A0<font face=3D"monospace"> acl annotate_groups =
annotate_client groups=3D%{group}note</font><br>=C2=A0<br>2. How do you thi=
nk,=C2=A0should we process the &quot;<font face=3D"monospace">group</font>&=
quot; attribute at the connection state level as we do with the &quot;<font=
 face=3D"monospace">clt_conn_tag</font>&quot;? I think this can be easily i=
mplemented in the <font face=3D"monospace">UpdateRequestNotes()</font> func=
tion (<font face=3D"monospace">src/HttpRequest.cc</font>) by simply copying=
 and pasting a few lines of code:<div><font face=3D"monospace">void<br>Upda=
teRequestNotes(ConnStateData *csd, HttpRequest &amp;request, NotePairs cons=
t &amp;helperNotes)<br>{<br>=C2=A0 =C2=A0 // Tag client connection if the h=
elper responded with clt_conn_tag=3Dtag or group=3Dgroups.<br>=C2=A0 =C2=A0=
 const char *cltTag =3D &quot;clt_conn_tag&quot;;<br>=C2=A0 =C2=A0 if (cons=
t char *connTag =3D helperNotes.findFirst(cltTag)) {<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 if (csd) {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 csd-&gt;=
notes()-&gt;remove(cltTag);<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 cs=
d-&gt;notes()-&gt;add(cltTag, connTag);<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 }<br=
>=C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 const char *group =3D &quot;group&quot;;<=
br>=C2=A0 =C2=A0 if (const char *hlprGroup =3D helperNotes.findFirst(group)=
) {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (csd) {<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 csd-&gt;notes()-&gt;remove(group);<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 csd-&gt;notes()-&gt;add(group, hlprGroup);<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 request.note=
s()-&gt;replaceOrAdd(&amp;helperNotes);<br>}</font></div></div><br><div cla=
ss=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_at=
tr">=D0=B2=D1=82, 3 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 16:02, =
Amos Jeffries &lt;<a href=3D"mailto:[email protected]">[email protected]=
.nz</a>&gt;:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px=
 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On =
04/03/2026 01:06, Andrey K wrote:<br>
&gt; Hello,<br>
&gt; <br>
&gt; I use=C2=A0negotiate_kerberos_auth helper and it sets the AD groups li=
st in a <br>
&gt; group annotation attribute.<br>
&gt; It works well, but thisattributeis not availableinthe <br>
&gt; subsequentrequestsinan ssl-bumpedconnection (it is available only in t=
he <br>
&gt; first CONNECT request).<br>
&gt; Is it possible to make this attribute persistent in the current SSL <b=
r>
&gt; connection? I would like to use groups from this attribute to authoriz=
e <br>
&gt; users using only &quot;note&quot;-type ACLs, no external helpers invol=
ved.<br>
<br>
Unfortunately Squid does not yet support ACLs using details directly <br>
from the tunnel&#39;s &quot;parent&quot; CONNECT transaction.<br>
<br>
You can use the annotate_client ACL type to mark the from-client TCP <br>
connection instead of the HTTP request. Just be aware these need to be <br>
manually configured and thus does not scale to large number of groups.<br>
<br>
HTH<br>
Amos<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">squi=
[email protected]</a><br>
<a href=3D"https://lists.squid-cache.org/listinfo/squid-users" rel=3D"noref=
errer" target=3D"_blank">https://lists.squid-cache.org/listinfo/squid-users=
</a><br>
</blockquote></div>

--0000000000007721e5064c2d012c--

--===============0774634225087077722==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============0774634225087077722==--