Integration with Microsoft Active Directory

Note

If you are looking for the web filtering solution that runs natively on Microsoft Windows and can be integrated with Active Directory using a couple of mouse clicks, consider taking a look at Web Filtering Proxy for Microsoft Windows. If deployed on a domain-joined machine, the Kerberos and NTLM single-sign-on are automatically supported with zero administrative efforts.

The following steps show how to integrate Squid proxy with Microsoft Active Directory and set up Web Safety ICAP filter to use group membership information of the authenticated users to perform automatic selection of a corresponding web filtering policy.

• Assumptions and prerequisites
• Step 1. Configure IP address and DNS settings
• Step 2. Syncronize time
  • Set correct Time Zone in Web Safety
  • Enable time sync with Active Directory and vSphere
• Step 3. Create User for Kerberos and LDAP authentication
• Step 4. Link to Active Directory domain
• Step 5. Configure Kerberos authentication on Squid
  • Ensure Kerberos client libraries are installed
  • Generate KeyTab file and enable Kerberos auth
• Step 6. Enable NTLM authentication on Squid
• Step 7. Enable Basic LDAP authentication on Squid
• Generated Configuration Files
• Squid Configuration with Proxy Authentication
• How to Check Proxy Authentication on Squid
• LDAP groups as Members in Web Filter Policies
• Required Search Permissions in Active Directory
• Troubleshooting Squid Active Directory Integration
  • Check the SPN is Mapped to One User Only
  • Capture Auth Packes with WireShark