Writing Squid authenticators

An authenticator that you can use in Squid is pretty simple. So if you find you need to use an authentication scheme that is not yet supported you can pretty easily write one yourself. All you need is some basic knowledge of scripting languages (bash, Perl, Python, whatever).

The authentication requests are passed to the external authenticator like this:

• Squid launches a number of authenticators (instances of your script)
• Each authenticator waits for input (STDIN) and parses it line by line. It never exits!
• Squid sends lines like "USERNAME PASSWORD" to the authenticator. Just one pair of username and password per line.
• The authenticator reads the line, decides whether the credentials are okay and either prints "OK" or "ERR" out to STDOUT.

This is an example framework for an authenticator in Perl:

use strict;

while (<STDIN>)
{
        chomp;
        my ($username, $password) = split;
        &authenticate($username, $password);
}

sub authenticate
{
        my ($username, $password) = @_;
        if (...)        # authentication ok
        {
                print "OK\n";
        }
        else    # authentication failed
        {
                print "ERR\n";
        }
}

Of course you need to add your own authentication mechanism in the &authenticate sub where the "…" are.