Thanks Amos I'm pretty new to squid and trying to catch up as fast as i can but still some of your statement are difficult for me to understand. What i posted are all the http rules i've got. Everything works fine, except for this little issue with the IPUser. When a user with novell client tries to access a page and it is not a restricted, it is authenticate transparently and page is displayed. When a user with no novell client request a page, browser present the auth page and after enter username/pass, page is served or denied. Up here is fine. Now the remaining issue is when an IPUser request a banned page, instead to get the deny message, it get the auth page to introduce username/password. This is what i want to change, just send the forbidden. I've tried Chad suggestion but i still can not make it work. This is how it looks my squid.conf. auth_param basic program /usr/sbin/squid_ldap_auth -Z -D cn=xxxx,o=laboratorio -w xxxx -b o=laboratorio -s sub -f "(&(objectclass=User)(cn=%s))" -h 192.168.0.205 -p 389 auth_param basic children 5 auth_param basic realm Squid proxy-caching web server auth_param basic credentialsttl 2 hours auth_param basic casesensitive off # external_acl_type IPUser ttl=7200 %SRC /etc/squid/squid_edir_iplookup.pl # external_acl_type ldap_group %LOGIN /usr/sbin/squid_ldap_group -Z -D "cn=xxxx,o=laboratorio" -w "xxxx" -b "o=laboratorio" -s sub -f "(&(objectClass=Person)(cn=%u)(groupMembership=cn=%g,ou=servicios,ou=gye,o=laboratorio))" -h 192.168.0.205 -p 389 #Recommended minimum configuration: acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl Auth_Not_Required src "/etc/squid/auth_not_required.txt" # Domains accessible to all PC's acl Open_Domains url_regex -i "/etc/squid/open_domains.txt" # Hosts & domains that are denied to restricted users acl Banned_URLs url_regex -i "/etc/squid/banned_urls.txt" # Seemless automatic access based on IP address # Access through the "IP User" external helper acl Full_Access external IPUser internet_nr acl Restricted_Access external IPUser internet_r # Access to users prompted with username/password dialogue # Full access acl lab_Full external ldap_group internet_nr # Restricted access acl lab_Restricted external ldap_group internet_r # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports # Domains free to all users without needing to authenticate. http_access allow Open_Domains # IP addresses of hosts that don?t need to authenticate (usually automation hosts #performing automated downloads and without a Novell client. http_access allow Auth_Not_Required # Let users with full Internet access discovered by the IPUser method go anywhere. http_access allow Full_Access # Let users with restricted Internet access discovered by the IPUser method go #anywhere except for the ban list http_access allow Restricted_Access !Banned_URLs # If the IPUser method fails then we need to revert to username/password #authentication # Let users with full access who entered username/password go anywhere http_access allow lab_Full # Ban list again http_access deny Banned_URLs # Let users with restricted access who entered username/password go anywhere (that # hasn?t been already excluded in the ban list). http_access allow lab_Restricted # # Example rule allowing access from your local networks. Adapt # to list your (internal) IP networks from where browsing should # be allowed #acl our_networks src 192.168.1.0/24 192.168.2.0/24 #http_access allow our_networks http_access allow localhost # And finally deny all other access to this proxy http_access deny all # and finally allow by default http_reply_access allow all I'm sure i'm doing something wrong and probably rearranging the rule order may help, just i can not figure out how. I'm still learning how control rules are implemented in squid Thanks a lot for nay help you may provide Gonzalo >>> Amos Jeffries <squid3@xxxxxxxxxxxxx> 1/2/2011 12:40 AM >>> You have presented the settings for IPUser ACL but have omitted the ones for ldap_group ACL. I suspect you have cut-n-pasted one of the common examples for group lookup which rely on full client credentials authentication. Note that external ACL does not produce full-blown authentication credentials (yet). So they are not used for %LOGIN group checking. You need to use %EXT_USER instead and you do not have access to the external ACL password. Check this, but I expect you may find that the way you have defined the IPUser ACL lines the helper gets passed "<src-IP> <group-name>" so you can do the full check in one step in the handler script with a single allow/block result. Amos
