Re: Using AD groups from negotiate_kerberos_auth in ssl-bumped connections.

--===============4862068471910649808==
Content-Type: multipart/alternative; boundary="000000000000637bbd064dedafd9"

--000000000000637bbd064dedafd9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello, Amos,

Thank you for clarifying.

I've opened a PR (https://github.com/squid-cache/squid/pull/2395) for the
negotiate_kerberos_auth helper to support custom annotation attributes for
PAC groups. The output format has been changed to a single key with
comma-separated values. This allows using attributes like clt_conn_tag to
annotate connections.

Kind regards,
    Ankor.



=D1=87=D1=82, 26 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 01:03, Amo=
s Jeffries <[email protected]>:

> On 26/03/2026 00:55, Andrey K wrote:
> >
> > Hello Alex and Amos,
> >
> > I ran some more tests and would like to share the results.
> >
> > It turned out that the following auth helper responses are equivalent:
> >    OK user=3Duser1 group=3Dgroup1 group=3Dgroup2
> >    OK user=3Duser1 group=3Dgroup1,group2
> >    OK user=3Duser1 group=3D"group1,group2"
> >
>
> As Alex pointed out "group" key name has special handling that
> essentially converts the first line into the second.
>
> The difference of output is more important for the clt_conn_tag use
> where the first line would mark the connection with
> "clt_conn_tag=3Dgroup1", then immediately replace it with
> "clt_conn_tag=3Dgroup2".
>
> Double-quotes as used on the third line are supported to allow
> whitespace and \-escaped characters to exist within values. As used
> above line 2 and 3 are exactly the same - the annotation value is a
> comma-delimited list of group names.
>
>
> > It also turned out that using the -m flag in the ACL note is
> > unnecessary: the ACL
> >    acl has_group2 note group group2
> > matches each of the three above responses.
>
> Because all three cases add a note "group=3Dgroup2".
>
> Again the special case for "group"  key name has changed line #1 to mean
> the same as the others.
>
>
> > However, the ACL
> >    acl has_2groups note group group1,group2
> > did not match any of them.
>
> Nod. ',' is a delimiter for notes with a list of values.
> The ACL tests each value separately against the squid.conf value.
>
>
> Cheers
> Amos
>
>

--000000000000637bbd064dedafd9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello, Amos,<div><br></div><div>Thank you for clarifying.<=
/div><div><br></div><div>I&#39;ve opened a PR (<a href=3D"https://github.co=
m/squid-cache/squid/pull/2395">https://github.com/squid-cache/squid/pull/23=
95</a>) for the <font face=3D"monospace">negotiate_kerberos_auth</font> hel=
per to support custom annotation attributes for PAC groups. The output form=
at has been changed to a single key with comma-separated values. This allow=
s using attributes like <font face=3D"monospace">clt_conn_tag</font> to ann=
otate connections.</div><div><br></div><div>Kind=C2=A0regards,</div><div>=
=C2=A0 =C2=A0 Ankor.</div><div><br></div><div><br></div></div><br><div clas=
s=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_att=
r">=D1=87=D1=82, 26 =D0=BC=D0=B0=D1=80. 2026=E2=80=AF=D0=B3. =D0=B2 01:03, =
Amos Jeffries &lt;<a href=3D"mailto:[email protected]">[email protected]=
.nz</a>&gt;:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px=
 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On =
26/03/2026 00:55, Andrey K wrote:<br>
&gt; <br>
&gt; Hello Alex and Amos,<br>
&gt; <br>
&gt; I ran some more tests and would like to share the results.<br>
&gt; <br>
&gt; It turned out that the following auth helper responses are equivalent:=
<br>
&gt;=C2=A0 =C2=A0 OK user=3Duser1 group=3Dgroup1 group=3Dgroup2<br>
&gt;=C2=A0 =C2=A0 OK user=3Duser1 group=3Dgroup1,group2<br>
&gt;=C2=A0 =C2=A0 OK user=3Duser1 group=3D&quot;group1,group2&quot;<br>
&gt; <br>
<br>
As Alex pointed out &quot;group&quot; key name has special handling that <b=
r>
essentially converts the first line into the second.<br>
<br>
The difference of output is more important for the clt_conn_tag use <br>
where the first line would mark the connection with <br>
&quot;clt_conn_tag=3Dgroup1&quot;, then immediately replace it with <br>
&quot;clt_conn_tag=3Dgroup2&quot;.<br>
<br>
Double-quotes as used on the third line are supported to allow <br>
whitespace and \-escaped characters to exist within values. As used <br>
above line 2 and 3 are exactly the same - the annotation value is a <br>
comma-delimited list of group names.<br>
<br>
<br>
&gt; It also turned out that using the -m flag in the ACL note is <br>
&gt; unnecessary: the ACL<br>
&gt;=C2=A0 =C2=A0 acl has_group2 note group group2<br>
&gt; matches each of the three above responses.<br>
<br>
Because all three cases add a note &quot;group=3Dgroup2&quot;.<br>
<br>
Again the special case for &quot;group&quot;=C2=A0 key name has changed lin=
e #1 to mean <br>
the same as the others.<br>
<br>
<br>
&gt; However, the ACL<br>
&gt;=C2=A0 =C2=A0 acl has_2groups note group group1,group2<br>
&gt; did not match any of them.<br>
<br>
Nod. &#39;,&#39; is a delimiter for notes with a list of values.<br>
The ACL tests each value separately against the squid.conf value.<br>
<br>
<br>
Cheers<br>
Amos<br>
<br>
</blockquote></div>

--000000000000637bbd064dedafd9--

--===============4862068471910649808==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============4862068471910649808==--