Re: 2.6stable5 icap client - reqmod problems with webwasher 5.x and 6

Nop, it won't ! Actually there are several reasons it won't

1.) Webwasher expects a group or a username to be used within a webwasher
defined LDAP query. That way I do not need the auth_scheme

2.) the auth_sheme as proposed is short of fullfilling the needed abstaction

Let's assume your AD is based on root dc=test,dc=intra. Users can be based
on ou=admin_users or ou=normal_users. So the needed URI would either be

LDAP://<server>/cn=%u,ou=%o,dc=%d,dc=intra

None of the infos you can get from a SMB/NTLM/ADS auth will supply the
needed OU (%o) info for your auth sheme. Actually this is a rather simple
setup. Actually I know of more then one customer to spread it's userbase
throughout several OU's.

As there is a rather small base of commercially available ICAP
implementations and none of those I know of actually use the auth-sheme we
can still think about writing our own ICAP Server. In this case such a
server would rather need an new auth sheme like

AD://user:%u,domain:%d

This would work in any LDAP query like

Ldapsearch -X -h <server> -b %d,dc=intra samaccountname=%u

Regards,
Axel

Am 21.11.2006 20:46 Uhr schrieb "Jeremy Hall" unter
<jehall@central.unicor.gov>:

> Does it work for your setup?
>
> _J
>
>>>> "Westerhold, Axel" <Axel.Westerhold@dts.de> 11/21/06 1:32 PM >>>
> Hi Jeremy,
>
> That definately more then I need to do :-) ! I will just have to get
> rid of
> the domain but your approach might be better for the future.
>
> Axel
>
>
>
> Am 21.11.2006 19:26 Uhr schrieb "Jeremy Hall" unter
> <jehall@central.unicor.gov>:
>
>> Hello,
>>
>> Here is the icap patch I am working on. It might not fully work,
>> probably won't break much tho. It's not ready for merging, and the
>> debug statements are wrong (shouldn't be prio 1) but I'm trying to
> work
>> out the kinks before readying it for merge.
>>
>> _J
>>
>>>>> "Westerhold, Axel" <Axel.Westerhold@dts.de> 11/21/06 12:54 PM >>>
>> Hi All,
>>
>> I will have a look at the squid3 but I will need to modify it a
> little
>> bit
>> so that I can split the Domain Part of the Username to make the
>> webwasher
>> happy on ist AD samaccount queries. From what I can see it should be
>> easy
>> enough to get this done inlcuding a way to enable/disable this
> feature
>> (like
>> the one I did for 2.x).
>>
>> Also, I just shipped a 2.6 ICAP Patched Squid in a cluster setup to
> a
>> customer with 1000 Users. This Pilot Installation will get me a good
>> feeling
>> how stable 2.6 works.
>>
>> Regards,
>> Axel
>>
>>
>> Am 20.11.2006 22:57 Uhr schrieb "Tsantilas Christos" unter
>> <chtsanti@users.sourceforge.net>:
>>
>>> Hi all,
>>> The reported problems exists and are not webwasher related, exists
>> for
>>> every icap server.
>>>
>>> Axel's solutions causes crashes to squid in some cases. I think it
>>> happens when http client closes the connection before the
> connection
>> to
>>> the icap server closed. I am not sure it needs more debugging.
>>> I am planning to give some more time...
>>>
>>> However, the squid3 with icap client is more stable than squid-26
>> with
>>> icap patch. I think the squid3 has only 2-3 bugs before the
> release.
>>> My opinion is that it does not make sense for someone to spend time
>> in
>>> squid26 icap client, it is good for testing and development but
> only
>>> that .....
>>>
>>> Regards,
>>> Christos
>>>
>>> Westerhold, Axel wrote:
>>>> Well,
>>>>
>>>> as I have a customer waiting for a fix I will just go with my
>> modification
>>>> and will try to pin down the real fault when I have some free time
>>>> available. Setting the major version the way I do should not have
> a
>> real
>>>> impact at least I can't see one right now on my test system.
>>>>
>>>> Regards,
>>>> Axel
>>>>
>>>>
>>>>
>>>