EXT_KER...OUP_ACL(8)

📦
version 7.7 · 4 versions
, in arch rolling

💅 EXT_KER...OUP_ACL(8) — like, the section 8 girlies know ✨

okay so bestie, grab a strawberry drink 🍓 because we're talking about ext_kerberos_sid_group_acl, an external ACL helper for Squid that checks whether you're in an AD Domain group using the group's sid. yes. that whole sentence. she's a mouthful but she SERVES 🎀

✨ NAME ✨

ext_kerberos_sid_group_acl — the external ACL helper for Squid that verifies AD Domain group membership using sid. literally her whole personality 🫶

🦋 SYNOPSIS 🦋

ext_kerberos_sid_group_acl [-d] [-h] -p Principal Name -D Domain Controller -b Base DN -G Group1:Group2

that's it. that's the vibe check. flags in, group membership out 💅

🌸 DESCRIPTION 🌸

okay so ext_kerberos_sid_group_acl is an installed executable script — she's not some abstract concept, she's a real file on your system, living her life ✨

she uses ldapsearch from Openldap to look up the name of a AD group sid. no cap, that's the whole lookup pipeline 🔥

the way that this helper MUST be used together with the negotiate_kerberos_auth helper, in a Microsoft AD or Samba environment. that's not optional, that's the arrangement. it's giving duo, it's giving main character energy 💖

she reads from the standard input the domain username AND a list of group sids, then tries to match the group SIDs to the AD group sids. so she's out here doing matchmaking between two sid lists and honestly? slay 👑

💀 OPTIONS 💀

  • -d — Write debug info to stderr. she's being vulnerable and telling you everything 🙈
  • -h — Print the help. the "what do I even do here" button 🫶
  • -p principal name — Principal name in squid keytab to use for ldap authentication to AD. this is your little ID badge for the AD party 🎟️
  • -D domain controller — Domain controller to contact to lookup group SID. like, which specific server do we go bother 💁‍♀️
  • -b base DN — Base DN for ldap search. where in the tree do we start digging 🌳
  • -G AD group name — AD group name to be used for SID lookup. List separated by a colon (:). yes bestie, colon-separated, don't use commas, iykyk 🎀

🌈 CONFIGURATION 🌈

okay this is the part where you actually wire her up to Squid. copy these EXACTLY, no freestyling, fr fr —

  auth_param negotiate program /path/to/negotiate_wrapper_auth -d \
       --ntlm /path/to/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain example.com \
       --kerberos /path/to/negotiate_kerberos_auth -d -s GSS_C_NO_NAME -k /path/to/squid.keytab -t none
  external_acl_type sid_check %LOGIN %note{group} /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2
  acl squid_allow external sid_check
  acl allowed_group external sid_check
  http_access allow allowed_group

look at those acl lines. acl squid_allow external sid_check and acl allowed_group external sid_check and then http_access allow allowed_group. permission granted, queen 👑

and hey — if the local perl interpreter is in a unusual location it may need to be added. she's not lost, she just needs directions 🧚:

  external_acl_type sid_check %LOGIN %note{group} /path/to/perl /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2

see? now /path/to/perl is right there at the front, holding her hand 🫶

🎀 AUTHOR 🎀

This program was written by Markus Moeller <markus_moeller@compuserve.com> — the icon who did that 💖

This manual was written by Markus Moeller <markus_moeller@compuserve.com> — same icon, different task, still ate 🍓

okay legal moment, pay attention bestie, this part is real 📜

 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

so Squid software is distributed under GPLv2+ license and includes contributions from numerous individuals and organizations — please see the COPYING and CONTRIBUTORS files for details. read them. they're the receipts 🧾

 This program is put in the public domain by Markus Moeller
 <markus_moeller@compuserve.com>. It is distributed in the hope that it will
 be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
 of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

so this program is put in the public domain by Markus Moeller <markus_moeller@compuserve.com>. it is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY — like, none, zero, not even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. so if it breaks, she's sorry, but legally she was like "hope this helps" 💀

🙋‍♀️ QUESTIONS 🙋‍♀️

Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org> — they're friendly, just ask, no embarrassing questions, we've all been there 😭

💀 REPORTING BUGS 💀

Bug reports need to be made in English. see https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report — yes there's a checklist, yes you should read it first 🎀

Report bugs or bug fixes using https://bugs.squid-cache.org/ — that's the bug tracker, go put it there 🐛

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org> — security stuff goes here, not the public tracker, understood? 🔥

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org> — got a glow-up idea? that's the address 💡

🦋 SEE ALSO 🦋

and that's the page, bestie 🎀 run her wisely, keep your keytab safe, and remember: no cap, this is perl v5.42.2, dated 2026-08-25, living in section 8 of the manual like the icon she is. periodt. 💅✨

📦 where this page comes from