<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
We have a "problem" with ACLs, and I don't know how to address this
situation in Squid 5.8<br>
Let me explain:<br>
We have an Active Directory group named limited_users that is only
allowed to surf on a very limited list of websites.<br>
These users are therefore forbidden to surf on all sites not listed
in allowed_domains<br>
On the other hand, we have websites in noauth_sites that do not need
to be authenticated by squid but are not allowed to be used by
limited_users group<br>
<br>
In logic, we would write the following ACLs.<br>
<br>
<pre class="moz-signature" cols="72">external_acl_type ads_group ttl=3600 negative_ttl=1 concurrency=50 children-startup=1 children-idle=1 children-max=20 ipv4 %LOGIN /lib/squid3/groups.pl
acls limited_users ads_group limited_users
acls allowed_domains dstdomain siteallowed.com
acls allowed_domains dstdomain siteallowed.fr
acls allowed_domains dstdomain siteallowed.ch
acls noauth_sites dstdomain office365.com
http_access deny !allowed_domains limited_users all #ACL1
http_access allow noauth_sites #ACL2</pre>
<br>
But in this case, accessing to office365.com force Squid to send the
407 Authentication request in order to calculate the limited_users
in #ACL1, then the second ACL is not effective because the request
is blocked before by the 407.<br>
The %LOGIN switch in the external ACL ads_group activates the
identification mode.<br>
If we use the %un switch instead , it works but it becomes the
counter, ACL#1 is not processed anymore since the authentication is
not requested because the %un switch is too smooth.<br>
<br>
What I don't understand is that SQUID is trying to calculate the
limited_user object when the first allowed_domain object already
returns FALSE.<br>
Whatever the result of the objects that follow allowed_domain, the
rule will always fail.<br>
In the case where limited_user is in the first place, the logic is
correct.<br>
<br>
Two questions: <br>
<br>
Is there a way for SQUID to not compute all http_access objects if
the first one fails?<br>
<br>
What would be the best rule that could meet this goal?<br>
<br>
regards<br>
</body>
</html>