On 4/02/2012 2:23 p.m., John H. Nyhuis wrote:
I'm trying to set up squid as a proxy for a Microsoft Exchange OWA server, and would appreciate it if someone could point out what I am missing in my squid.conf When I connect directly to OWA using a browser, I am presented with a username / password dialogue, and can log in. When I connect through squid, I do not receive the username / password dialogue, and squid logs a TCP_MISS/403. I think squid is not passing the authentication dialogue back to the client, and then the connection times out. squid version: squid3-3.1.16-57.2 exchange version: 2010 squirm is used to rewrite the requests squid sends to the target exchange server
Sigh. Exchange is VERY sensitive to the nature of requests it receives. I suspect very much that this URL re-writing is part of the problem.
Start with re-considering *why* your Exchange server and Outlook clients are not communicating the correct URLs between each other and what can be done to their configuration to fix that.
squid.conf: (with IP's removed) https_port<squid's IP>:443 accel cert=/etc/squid/ssl/0123trial.com.crt key=/etc/squid/ssl/0123trial.com.key defaultsite=<exchange server> vhost protocol=https cache_peer<squid's IP> parent 443 0 no-query originserver login=PASS ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=owaServer acl OWA dstdomain<exchange server> extension_methods RPC_IN_DATA RPC_OUT_DATA cache_peer_access owaServer allow OWA never_direct allow OWA redirect_program /usr/local/squirm/bin/squirm redirect_children 1 A connection attempt through squid to the exchange server on a browser is logged in access.log as follows https://<squid's IP>/testuser@<exchange server>/ access.log: 1328317941.803 0<squid's IP> TCP_MISS/403 4601 GET https://<squid's IP>/testuser@<exchange server>/ - NONE/- text/html 1328317941.804 8 5.36.162.200 TCP_MISS/403 4736 GET https://<squid's IP>/testuser@<exchange server>/ - DIRECT/<squid's IP> text/html I'd be much obliged if someone could point out what I have misconfigured.
You have configured the cache_peer linkage (which should be Squid->Exchange) to be Squid->Squid.
Then there is that mangled URL fooling Exchanges to identifying its domain scope as "<Squid's IP>", with undefined results.
Amos
