I netadmin a school. The school connects to the outside world via a VPN implemented on equipment ouside my control (all in-school hosts have 10.x.x.x IP addresses). The only way out to the Web is via an upstream filtering proxy server that serves multiple schools.
The school has a local Squid proxy under my complete control, which all the school browsers are configured to use. It's currently set up to use the upstream proxy as its parent and pass user credentials through, except for a whitelist of domains and URLs for which I have Squid supply preset credentials. This allows me, among other things, to make selected YouTube videos accessible to students even though the upstream (domain-level) filter restricts YouTube as a whole to staff, and to let stuff like update checks happen quietly without pestering users for credentials at inconvenient times.
Upstream has recently decided to cut over from its ISP-supplied web filter to Zscaler, which doesn't seem to use HTTP authentication; it does some complicated browser-based dance with redirection, HTTPS and cookies instead.
Does anybody know of a way to configure Zscaler to require authentication credentials per request rather than per browser session, and to configure Squid to supply those?