Your trace ends with the login credentials being sent to your basic auth helper for validation. 1. An unauthenticated request being denied with 407. 2. Client coming back with login credentials. 3. Squid seeing the %LOGIN requirement and sends the login credentials to your basic auth helper for validation. [end of pasted trace] It never got as far as trying to use your external acl helper. Regards Henrik
