I want to integrate a Squid proxy with an Active Directory domain, so that the following is achieved:
- I can grant/deny access to web sites based on user accounts and/or groups.
- Domain users don't need to explicitly authenticate when accessing the proxy, i.e. they automatically use their Windows logon credentials.
- Unauthenticated users can still be granted access (to specific destinations).
The two last points are my main concern; I know Squid can authenticate users against AD, but I don't know if it can manage authenticated and anonymous users at the same time, and if it can use transparent authentication, i.e. without requiring the user to explicitly log in to the proxy server.
Also, I know there are two ways to integrate Squid with AD: WinBind and LDAP. Which one is better for this scenario?
I don't need Squid to be a transparent proxy; there's already a GPO in place which configures IE proxy settings for all domain users.
Bonus question: can all of this work when SquidGuard is involved, too?