<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
<br>
<div class="moz-forward-container">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<font face="Arial">Thanks Amos<br>
<br>
You means using "login=PASS" in peer settings and in Proxy
parent B and C use the "basic_fake_auth" helper to "simulate"
the requested auth ?<br>
<br>
<br>
</font><br>
<div class="moz-cite-prefix">Le 17/11/2020 à 11:43, Amos Jeffries
a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:edaf8249-05aa-172c-e618-798d12176dbc@treenet.co.nz">On
17/11/20 9:27 pm, David Touzeau wrote: <br>
<blockquote type="cite"> <br>
Hi, <br>
<br>
We a first Squid using Kerberos + Active Directory
authentication. <br>
This first squid is used to limit access using ACls and Active
Directory groups. <br>
<br>
This first squid using parents as peer in order to access to
internet in this way: <br>
<br>
| --------> SQUID B
----------> Internet 1 <br>
squid A -------------> <br>
| ---------> SQUID C
---------> Internet 2 <br>
<br>
1) We want using ACLs too ( for delegation purpose ) on Squid
B and C <br>
2) For legal logs purpose compliance. <br>
<br>
In this case, the username discovered in SQUIDA must be
transmitted to SQUID B AND C and SQUID B-C must accept the
information in order to use as login information to parse acls
<br>
<br>
Is it possible ? <br>
</blockquote>
<br>
You can send the username. But the security token is tied to the
client<->SquidA TCP connection - it cannot be validated by
other servers than SquidA. <br>
<br>
This should not matter though. Since Squid A is only permitting
authenticated traffic you can *authorize* at Squid B and C based
only on the source being one of your Squid with valid username.
<br>
<br>
<br>
<blockquote type="cite"> <br>
If not: wee have seen that the Proxy protocol accept to
transmit the source IP/login information to peers that are
compliance with proxy protocol. <br>
but the peers method in squid did not allow to use Proxy
protocol. <br>
Is it possible to add the "Proxy Protocol" support in peers
method ? <br>
<br>
</blockquote>
<br>
It is possible to implement (for Squid-6 earliest) PROXYv2 for
cache_peer. But the credentials security token remains tied to
SquidA service. <br>
<br>
<br>
Amos <br>
_______________________________________________ <br>
squid-users mailing list <br>
<a class="moz-txt-link-abbreviated"
href="mailto:squid-users@lists.squid-cache.org"
moz-do-not-send="true">squid-users@lists.squid-cache.org</a> <br>
<a class="moz-txt-link-freetext"
href="http://lists.squid-cache.org/listinfo/squid-users"
moz-do-not-send="true">http://lists.squid-cache.org/listinfo/squid-users</a>
<br>
</blockquote>
<br>
</div>
</body>
</html>