The issue is many layers of caching and interdependent data.
Amos
Once the auth backend system is producing the right output the group helper cache needs to expire, then lookups by that helper will be correct.
Then all the tcp connections holding onto that users credentials need to close. Only once all that happens will there be no user+group1 link to confuse.
If any of the old tcp connections remain open they cache the old credentials which were linked to the old group1. New tcp connections will be linked to their cached username state.
In modern squid the kerberos auth helper gives squid the list of groups at the same time as username. So there is no external ACL helper and its caching to get things mixed up. You should use the note ACL type to check those group SSIDs.
At worst you may still have to wait for tcp connections closure part.
Amos
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
