EXT\_KERBEROS\_SID\_GROUP\_ACL(8) User Contributed Perl Documentation EXT\_KERBEROS\_SID\_GROUP\_ACL(8)

# [NAME](#NAME)

```
 ext_kerberos_sid_group_acl - external ACL helper for Squid to verify AD Domain group membership using sid.
```

# [SYNOPSIS](#SYNOPSIS)

```
 ext_kerberos_sid_group_acl [-d] [-h] -p Principal Name -D Domain Controller -b Base DN -G Group1:Group2
```

# [DESCRIPTION](#DESCRIPTION)

**ext\_kerberos\_sid\_group\_acl** is an installed executable script. It uses **ldapsearch** from Openldap to lookup the name of a AD group sid.

This helper must be used in with the negotiate\_kerberos\_auth helper in a Microsoft AD or Samba environment.

It reads from the standard input the domain username and a list of group sids and tries to match the group SIDs to the AD group sids.

# [OPTIONS](#OPTIONS)

[**-d**](#d)

Write debug info to stderr.

[**-h**](#h)

Print the help.

[**-p principal name**](#p)

Principal name in squid keytab to use for ldap authentication to AD

[**-D domain controller**](#D)

Domain controller to contact to lookup group SID

[**-b base DN**](#b)

Base DN for ldap search

[**-G AD group name**](#G)

AD group name to be used for SID lookup. List separated by a colon (:)

# [CONFIGURATION](#CONFIGURATION)

```
  auth_param negotiate program /path/to/negotiate_wrapper_auth -d \
       --ntlm /path/to/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain example.com \
       --kerberos /path/to/negotiate_kerberos_auth -d -s GSS_C_NO_NAME -k /path/to/squid.keytab -t none
  external_acl_type sid_check %LOGIN %note{group} /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2
  acl squid_allow external sid_check
  acl allowed_group external sid_check
  http_access allow allowed_group
```

If the local perl interpreter is in a unusual location it may need to be added:

```
  external_acl_type sid_check %LOGIN %note{group} /path/to/perl /path/to/kerberos_sid_group_acl -p principal -D dc1.example.com -b "DC=example,DC=com" -G Group1:Group2
```

# [AUTHOR](#AUTHOR)

This program was written by Markus Moeller <markus\_moeller@compuserve.com>

This manual was written by Markus Moeller <markus\_moeller@compuserve.com>

# [COPYRIGHT](#COPYRIGHT)

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
 This program is put in the public domain by Markus Moeller
 <markus_moeller@compuserve.com>. It is distributed in the hope that it will
 be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
 of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
```

# [QUESTIONS](#QUESTIONS)

Questions on the usage of this program can be sent to the *Squid Users mailing list &lt;squid-users@lists.squid-cache.org*&gt;

# [REPORTING BUGS](#REPORTING_BUGS)

Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to *Squid Bugs &lt;squid-bugs@lists.squid-cache.org*&gt;

Report ideas for new improvements to the *Squid Developers mailing list &lt;squid-dev@lists.squid-cache.org*&gt;

# [SEE ALSO](#SEE_ALSO)

[**negotiate\_kerberos\_auth**(8)](/man/enterprise-packages/squid/negotiate_kerberos_auth.8)

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/

2026-10-25 perl v5.44.0

---

Document: ext_kerberos_sid_group_acl(8) from squid 7.7-r4 (Chainguard OS)
Source: https://github.com/squid-cache/squid.git