<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div style="background-color: #fdfdfd;" data-mce-style="background-color: #fdfdfd;">Hi <span style="font-family: Helvetica, Arial, sans-serif;" data-mce-style="font-family: Helvetica, Arial, sans-serif;">Youenn, thanks for your quick response. Actually I need to create a trust domain with an AD for disable NTLM auth and take advantage of FreeIPA. I thought to use Kerberos instead NTLM. It is possible to create a trust domain with AD and authenticate users with LDAP (FreeIPA)?</span></div><div><span style="font-family: Helvetica, Arial, sans-serif;" data-mce-style="font-family: Helvetica, Arial, sans-serif;"> </span></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Youenn PIOLET" <piolet.y@gmail.com><br><b>Para: </b>"Ing. Adrian Hernández Yeja" <ayeja@uci.cu><br><b>CC: </b>freeipa-users@redhat.com<br><b>Enviados: </b>Miércoles, 21 de Diciembre 2016 13:05:30<br><b>Asunto: </b>Re: [Freeipa-users] (no subject)<br><div><br></div><div dir="ltr">Hi Adrian,<div><br><div>You can use basic_ldap_auth to connect to FreeIPA using LDAP instead of negotiate_kerberos_auth :<div><div> </div><div>auth_param basic program /usr/lib/squid3/basic_ldap_auth -R \ </div><div> -b "cn=accounts,dc=example,dc=com" \ </div><div> -f uid=%s -h <freeipa-server> -ZZ </div><div>auth_param basic children 10 </div><div>auth_param basic realm infra.msv </div><div>auth_param basic credentialsttl 30 second </div><div> </div></div><div>Regards,</div></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><span face="arial, helvetica, sans-serif" data-mce-style="font-family: arial, helvetica, sans-serif;" style="font-family: arial, helvetica, sans-serif;"><div><span style="font-family:arial"><span face="arial, helvetica, sans-serif" data-mce-style="font-family: arial, helvetica, sans-serif;" style="font-family: arial, helvetica, sans-serif;"><div>--</div><div><span color="#666666" data-mce-style="color: #666666;" style="color: #666666;">Youenn Piolet</span></div><div><span size="1" color="#999999" data-mce-style="color: #999999; font-size: xx-small;" style="color: #999999; font-size: xx-small;"><a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a></span></div><div style="font-size:large"><span style="font-size:small"><span style="font-family:arial"><div><span face="tahoma, sans-serif" data-mce-style="font-family: tahoma, sans-serif;" style="font-family: tahoma, sans-serif;"><span style="font-family:arial,verdana,tahoma,sans-serif;font-size:11px"><span style="font-family:tahoma,sans-serif;font-size:small"><span color="#666666" data-mce-style="color: #666666;" style="color: #666666;"><span style="color:rgb(142,142,142);font-family:arial,verdana,tahoma,sans-serif;font-size:11px"><em><br></em></span></span></span></span></span></div><span color="#8E8E8E" face="arial, verdana, tahoma, sans-serif" data-mce-style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;" style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;"></span></span><span color="#8E8E8E" face="arial, verdana, tahoma, sans-serif" data-mce-style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;" style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;"></span><span color="#8E8E8E" face="arial, verdana, tahoma, sans-serif" data-mce-style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;" style="color: #8e8e8e; font-family: arial, verdana, tahoma, sans-serif;"></span></span></div></span></span></div></span></div></div>
<br><div class="gmail_quote">2016-12-21 17:53 GMT+01:00 Ing. Adrian Hernández Yeja <span dir="ltr"><<a href="mailto:ayeja@uci.cu" target="_blank">ayeja@uci.cu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi folks, I need authenticate my users against a squid proxy server using FreeIPA. I know is possible (<a href="https://www.freeipa.org/page/Squid_Integration_with_FreeIPA_using_Single_Sign_On" rel="noreferrer" target="_blank">https://www.freeipa.org/page/Squid_Integration_with_FreeIPA_using_Single_Sign_On</a>) but my users are not necessarily authenticated in a FreeIPA domain, so my question is if it's possible to allow this requirement either a third application or a specific configuration.<br>
<br>
Regards.<br>
<br>
La @universidad_uci es Fidel. Los jóvenes no fallaremos.<br>
#HastaSiempreComandante<br>
#HastalaVictoriaSiempre<br>
<span class="HOEnZb"><span color="#888888" data-mce-style="color: #888888;" style="color: #888888;"><br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project</span></span></blockquote></div><br></div>
</div><br></div>
<br><body>
<html>
<hr align="left" noshade="noshade" size="2" width="80%" />
La @universidad_uci es Fidel. Los jóvenes no fallaremos.
#HastaSiempreComandante
#HastalaVictoriaSiempre
<br>
<div style="clear:both"> </div>
</body>
</html>
<br></body></html>