Confused on NTLM Passthrough

[Matt Weisberg <matt@xxxxxxxxxxxx>]

I have a situation where I'd like to use squid as a proxy cache in  
front of another proxy (Scan Safe) that uses NTLM authentication.   
I've been trying to determine if squid can properly pass through the  
NTLM authentication.  Unfortunately, I'm quite confused as to if this  
is possible or not.  There seems to be ton of conflicting information  
on this.  Basically, I want this:

User (authenticated to AD Domain) --> Squid --> Scan Safe (requiring  
NTLM auth)

From what I can gather, I think this should work if I setup the cache  
peer with login=pass, but I'm not sure.  Basic auth is NOT allowed,  
NTLM is required.  It also seems that only certain versions of squid  
properly support NTLM pass through.  Is that correct?  If so, which  
versions?

Thanks.

Matt