Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to configure Squid as a reverse proxy with a custom authentication helper for each incoming requests. Every request to Squid is assumed to be with basic authentication. Any connection which fails the authentication, should be terminated. I am a newbie in Squid. Following is the configuration script I have used. This sample is to access "mindofaprogrammer.blog.com",

acl all src all
acl manager proto cache_object

http_port 80 accel defaultsite=mindofaprogrammer.blog.com
cache_peer mindofaprogrammer.blog.com parent 80 0 no-query originserver name=myAccel

acl myblog dstdomain mindofaprogrammer.blog.com
http_access allow myblog
cache_peer_access myAccel allow myblog
cache_peer_access myAccel deny all


auth_param basic program C:/wamp/bin/php/php5.3.0/php.exe "c:/squid/libexec/authhelper.php"
auth_param basic children 2
auth_param basic realm eReader
auth_param basic credentialsttl 5 hours

acl AuthUsers proxy_auth REQUIRED
http_access allow AuthUsers

access_log c:/squid/var/logs/access.log squid
coredump_dir c:/squid/var/cache

I have written the custom authentication helper in a PHP script. The listing of the same is as follows,

<?php
$f = fopen("php://stdin", "r");
while ($line = fgets($f)) {
        $line = trim($line);
        $fields = explode(' ', $line);
        $username = rawurldecode($fields[0]); //1738
        $password = rawurldecode($fields[1]); //1738
        if ($username == 'hello' 
            and $password == 'world') {
                fwrite(STDOUT, "OK\n");
        } else if ($username == 'fo'
            and $password == 'bar') {
                fwrite(STDOUT, "OK\n");
        } else {
                // failed miserably
                fwrite(STDOUT, "ERR\n");
        }
}
?>

The problem I am facing is, even after configuring this, only the reverse proxy settings are working not the authentication. Am I doing something wrong here?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Apparently I didn't realize that order of configuration statement matters in Squid. The following configuration worked for me. I am posting here for someone who need the same,

acl all src all
acl manager proto cache_object

auth_param basic program C:/wamp/bin/php/php5.3.0/php.exe "c:/squid/libexec/authhelper.php"
auth_param basic children 2
auth_param basic realm Enter credential to access the service
auth_param basic credentialsttl 5 hours

acl AuthUsers proxy_auth REQUIRED
http_access allow AuthUsers

http_port 80 accel defaultsite=www.google.com
cache_peer www.google.com parent 80 0 no-query originserver name=myAccel

acl GoogleSite dstdomain www.google.com
http_access allow GoogleSite
cache_peer_access myAccel allow GoogleSite
cache_peer_access myAccel deny all

access_log c:/squid/var/logs/access.log squid
coredump_dir c:/squid/var/cache

The custom authentication helper is still the same.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.