Secure authenticating in squid without Samba

Question

Situation:

I have a Squid server (3.0) and a LDAP server and the network setup looks like this:

                 Internet
                    |
                    |
                    |
Users <=====> [SQUID-Server] <====> [LDAP-Server]

I want to deny internet access to anonymous users and force authentication.

The users provided credentials will be passed to a local LDAP server and it authenticates their username/password and response to SQUID server to allow/deny that user.

---

The Problem:

The channel between SQUID and LDAP server is a local intranet and there is no problem with it.

The problem is the user sends its user/pass in plain-text format (encoded in Based64) to SQUID server and a someone can sniff the channel between Users and SQUID server to find the credentials (I think it is called The Basic-Authentication method).

---

One unpractical solution:

One solution to this problem is using a Samba server between SQUID and LDAP Server. something like this:

                 Internet
                    |
                    |
                    |
Users <=====> [SQUID-Server] <====> [SAMBA-Server] <====> [LDAP-Server]

and using the NTLM authentication in SQUID server to solve this problem.

I really don't think I need (or want) a SAMBA-Server.

---

Ideals for a good Solution:

1. It should secure the connection between Users and SQUID-Server. Securing connection between SQUID-Server and LDAP-Server is not required.

2. It possibly just need some configuration in SQUID-Server and no configuration in LDAP-Server if it is possible. But it must not need any other server (like Samba).