up vote 0 down vote favorite
share [g+] share [fb]

I have integrated Squid running on a gateway Debian machine with an LDAP directory.

I have an acl called ldaplogin for the ldap authentication configured with the right parameters. I also have rules like this using the acl

acl ldaplogin proxy_auth REQUIRED
http_access deny !ldaplogin
http_access allow localnet
http_access deny all

I have iptables redirect port 80 to port 3128 on the gateway machine running squid.

However, the browser running on a laptop which is behind the gateway doesn't ask for password at all. However, if I go to IE & set the IP of the gateway as proxy with port 3128, then in that case the browser asks for username/password.

Is there any way at all to have it working even without setting a proxy in the browser?

link|improve this question
40% accept rate
You'll need to clarify how the client computer is configured to find the proxy; are you expecting it to work without any proxy config/PAC file? – Shane Madden Mar 15 '11 at 17:21
@Shane Madden: He's using iptables to redirect client traffic to the proxy at the gateway. That's how he expects the client to "find" the proxy (i.e. the client doesn't know there's a proxy at all). – Evan Anderson Mar 15 '11 at 17:26
@Evan Completely missed that! Thanks. – Shane Madden Mar 15 '11 at 17:32
feedback

1 Answer

up vote 2 down vote accepted

Transparent HTTP proxies and proxy authentication don't work well together. The browser doesn't "know" that it's talking to a proxy server (since you're redirecting the traffic below layer 7) and you end up "breaking" sites that need HTTP authentication. (See the squid-cache wiki for some addt'l perspective).

Your best bet to get clients to use the proxy w/o having to manually alter client settings is probably to use a proxy auto-configuration file if you have clients that support it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.