OpenLDAP Integration
Integrate SafeSquid with OpenLDAP to enable centralized user identification and group-based access control for Linux/Unix-centric environments.Problem statement
Linux- and Unix-heavy environments still need attributable proxy identity and group-aware policy. Local proxy-only users do not scale well across centrally managed teams.Integration Workflow
Why use OpenLDAP with SafeSquid?
- Centralized Identity: Use your existing OpenLDAP directory for proxy authentication.
- Group-Based Access: Categorize users into groups (e.g.,
developers,marketing) and apply different filtering rules. - Linux Compatibility: Ideal for environments that don’t use Active Directory but require identity-based security.
- Audit Trails: Identity logs attribute all web activity to specific LDAP usernames.
Scope clarification
OpenLDAP is a confirmed directory integration path. Do not assume it provides the same Kerberos-style transparent SSO experience documented for Active Directory unless the target implementation proves that behavior in your environment.Verification
After configuring OpenLDAP:- Fetch Entries: Confirm that LDAP users and groups are listed in the LDAP Entities section of the SafeSquid interface.
- Log Check: Verify successful LDAP binds in
/var/log/safesquid/safesquid.log. - Policy Test: Ensure that a rule restricted to an LDAP group correctly allows members and blocks others.
Troubleshooting
Symptom: LDAP users exist, but authentication fails.Likely cause: Bind settings, base DN, or server reachability are wrong.
Isolation: Check the connection details and bind-related logs.
Remediation: Correct the LDAP settings and retry.
Retest: Authenticate with a known-good LDAP user. Symptom: Group-based policy does not differentiate users.
Likely cause: Group retrieval or mapping is incomplete.
Isolation: Confirm LDAP groups are visible in the interface and compare the policy scope.
Remediation: Correct the group mapping.
Retest: Compare different LDAP users against the same protected target.
Source register
Next steps
- Configure Simple Authentication to establish the connection.
- Configure SSO Authentication to enable user-aware policies.
- Access Restriction to define what your LDAP groups can access.