Re: Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.

--===============8346441221263512775==
Content-Type: multipart/alternative; boundary="000000000000659286064dd7f19e"

--000000000000659286064dd7f19e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Alex and Amos,

I ran some more tests and would like to share the results.

It turned out that the following auth helper responses are equivalent:
  OK user=3Duser1 group=3Dgroup1 group=3Dgroup2
  OK user=3Duser1 group=3Dgroup1,group2
  OK user=3Duser1 group=3D"group1,group2"

It also turned out that using the -m flag in the ACL note is unnecessary:
the ACL
  acl has_group2 note group group2
matches each of the three above responses.
However, the ACL
  acl has_2groups note group group1,group2
did not match any of them.

Kind regards,
    Ankor.

=D1=81=D1=80, 25 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 06:39, Amo=
s Jeffries <[email protected]>:

> On 25/03/2026 04:02, Alex Rousskov wrote:
> > On 2026-03-24 09:33, Amos Jeffries wrote:
> >
> >> Every clt_conn_tag should be added to the client<->Squid TCP
> >> connection, after which every transaction on that connection should be
> >> able to see them.
> >
> > The above assertion is false. Squid does not (or should not) work that
> > way since Bug 4912 fix (i.e. 2019 commit d665de37) replaced an "always
> > add" with an "always overwrite" design for most[^1] annotations,
> > including clt_conn_tag:
>
> Doh, forgot about that. Thanks Alex.
>
> Johnathan: the helper should use the comma-separated syntax Squid
> outputs in the log.
>
> HTH
> Amos
>
> _______________________________________________
> squid-users mailing list
> [email protected]
> https://lists.squid-cache.org/listinfo/squid-users
>

--000000000000659286064dd7f19e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><div dir=3D"ltr">Hello Alex and=
 Amos,<div><br></div><div>I ran some more tests and would like to share the=
 results.<br><br>It turned out that the following auth helper responses are=
 equivalent:<br><font face=3D"monospace">=C2=A0 OK user=3Duser1 group=3Dgro=
up1 group=3Dgroup2<br>=C2=A0 OK user=3Duser1 group=3Dgroup1,group2<br>=C2=
=A0 OK user=3Duser1 group=3D&quot;group1,group2&quot;</font><br>=C2=A0 <br>=
It also turned out that using the <font face=3D"monospace">-m</font> flag i=
n the ACL <font face=3D"monospace">note </font>is unnecessary: the ACL <br>=
<font face=3D"monospace">=C2=A0 acl has_group2 note group group2 </font><br=
>matches each of the three above responses.<br>However, the ACL<br><font fa=
ce=3D"monospace">=C2=A0 acl has_2groups note group group1,group2 </font><br=
>did not match any of them.</div><div><br></div><div>Kind=C2=A0regards,</di=
v><div>=C2=A0 =C2=A0 Ankor.=C2=A0<br></div></div><br><div class=3D"gmail_qu=
ote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">=D1=81=D1=
=80, 25 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 06:39, Amos Jeffrie=
s &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt;:=
<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8=
ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 25/03/2026 0=
4:02, Alex Rousskov wrote:<br>
&gt; On 2026-03-24 09:33, Amos Jeffries wrote:<br>
&gt; <br>
&gt;&gt; Every clt_conn_tag should be added to the client&lt;-&gt;Squid TCP=
 <br>
&gt;&gt; connection, after which every transaction on that connection shoul=
d be <br>
&gt;&gt; able to see them.<br>
&gt; <br>
&gt; The above assertion is false. Squid does not (or should not) work that=
 <br>
&gt; way since Bug 4912 fix (i.e. 2019 commit d665de37) replaced an &quot;a=
lways <br>
&gt; add&quot; with an &quot;always overwrite&quot; design for most[^1] ann=
otations, <br>
&gt; including clt_conn_tag:<br>
<br>
Doh, forgot about that. Thanks Alex.<br>
<br>
Johnathan: the helper should use the comma-separated syntax Squid <br>
outputs in the log.<br>
<br>
HTH<br>
Amos<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">squi=
[email protected]</a><br>
<a href=3D"https://lists.squid-cache.org/listinfo/squid-users" rel=3D"noref=
errer" target=3D"_blank">https://lists.squid-cache.org/listinfo/squid-users=
</a><br>
</blockquote></div></div>

--000000000000659286064dd7f19e--

--===============8346441221263512775==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============8346441221263512775==--