Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on setting up new web proxies at my job. We were initialy planning on buying Blue Coat proxys but the economic downturn came along and we're not buying them anymore...

The great feature that these proxys had was that they offered the possibility to authenticate users against several LDAP proxies. For example, a certain subnet of users authenticate against a specific LDAP serve while another subnet of users authenticate against another LDAP server.

Is this possible using open source software such as Squid ? I really like Pfsense because the interface is really simple and pretty, would it be possible to do such thing with it ?

Thank you in advance for your help,


share|improve this question
Does anyone have an idea ? – Antoine Benkemoun Sep 17 '09 at 13:47
up vote 2 down vote accepted

You cold make Squid authenticate against a single OpenLDAP server acting as a proxy for several backend directories. From slapd-meta(5):

NAME slapd-meta - metadirectory backend

SYNOPSIS /etc/ldap/slapd.conf

DESCRIPTION The meta backend to slapd(8) performs basic LDAP proxying with respect to a set of remote LDAP servers, called "targets". The information contained in these servers can be presented as belonging to a single Directory Information Tree (DIT).

This will work even if the DN hierarchies overlay among both groups by writing a few massaging rules -- I'm guessing that is the case because you would be using aliasing and delegation instead.

In any case I believe it is healthy that users are allowed to authenticate against the unified directory because their identity remains the same regardless of the subnet they happen to find themselves into.

share|improve this answer
That sounds much simpler. Thank you. – Antoine Benkemoun Sep 30 '09 at 6:14

In my answer, I'm assuming that you have read about the Squid authentication protocol, are familiar on how to configure an LDAP auth helper and are planning to run Squid under some kind of Unix operationg system. Furthermore, the first two answers help you chose different LDAP servers based on username, not IP subnet (you mentioned "subnet", but ITYM "subset" - right?).

  1. Use a simple script (language doesn't matter, use your favourite one) to forward the request to different LDAP servers based on the username. An experienced Unix administrator should get this up and running within 30 minutes, it's not a big deal.
  2. Use a single LDAP server which returns LDAP referrals based on the user's DN.

If you really want to change LDAP servers based on the IP subnet things will get a little ugly, since the Squid auth protocol only transmits username/password pairs to the auth helpers:

  1. Configure a single Squid server and have it listen on localhost only. This Squid instance will do all the caching work.
  2. For every subnet, set up another Squid instance, without a local cache, and configure the appropriate LDAP server. Use different ports for every Squid instance, too. These Squid instances forward all requests to the caching one defined in step 1.
  3. Depending on how you configure proxy settings in your users' browsers, you will have to use either DNS views or redirect rules in your webserver.
share|improve this answer
What I'm looking at is definently IP subnets... I guess subsets of users could be an option. The second option you are mentionning, I was already considering. I was thinking to use Solaris Zones to do this but it really smells fishy. – Antoine Benkemoun Sep 26 '09 at 8:21

You can build your own authentication helper for squid -

share|improve this answer
I don't really understand what you want me to do. Do I basically have to code a Squid module ? – Antoine Benkemoun Sep 25 '09 at 12:31
yep, very simple one. – Systemsninja Oct 2 '09 at 22:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.