Re: Replay Auth

[FredB <fredbmail@xxxxxxx>]

Hello again Amos,

Today I made a (ugly) patch for squid 3.2.13, who changes the credentialsttl behaviour

With auth_param basic credentialsttl 1 minute the user must replay his ident (of course if the negotiation is the second, BASIC). 
Better - for me - ! The digest (first identification) is proposed as new choice.

Of course if I disable the digest - so only with basic - the pop-pup will comes again every minutes.

I'm not a C++ expert, and I think there are some bad things, but it works pretty good
I thing a better way should be : add an option, something like auth_param basic credentialsttldisconnect

The "trick" is:

src/auth/UserRequest.h:    CRED_BANNED = -3

A new case in src/auth/UserRequest.cc

case Auth::CRED_BANNED:
     *auth_user_request = NULL 
      return AUTH_ACL_CHALLENGE;

For basic

src/auth/basic/UserRequest.cc

    case Auth::Ok:
        if (user()->expiretime + static_cast<Auth::Basic::Config*>(Auth::Config::Find("basic"))->credentialsTTL <= squid_curtime){
            // Avoid infinit loop //
                user()->expiretime = current_time.tv_sec;
                return Auth::CRED_BANNED;
        }
        return Auth::CRED_VALID;

I hope I forgot nothing

I have just one problem for the moment, sometimes the ident banner appear twice I guess there is a problem about user()->expiretime = current_time.tv_sec place when the user is beyond two minutes without browsing the timer is expired again, I will investigate ...

Thank

Fred