Adding an HTTP request header with Squid

Question

I want to permit my users to login to Google apps only for my domain. I found a solution by adding the HTTP header X-GoogApps-Allowed-Domains as described in this Google help page.

I use Squid, but can't figure out how to configure Squid to do this. How can I add this request header using Squid?

Solution 1

Do you can with new Squid 3.3 that support the command "request_header_add". I used CentOS for do it.

My Squid.conf is:

acl CONNECT method CONNECT
visible_hostname MySERVER.local
acl local src 192.168.0.0/24
http_access allow local
ssl_bump client-first all
always_direct allow all
http_port 3128 ssl_bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/etc/cert.pem
request_header_add X-GoogApps-Allowed-Domains "mycompany.com" all
cache_dir ufs /usr/local/squid/var/cache 8192 32 256

For SSL certificates, do you need to generate with openSSL:

openssl req -new -newkey rsa:1024 -days 36500 -nodes -x509 -keyout /usr/local/squid/etc/cert.pem -out /usr/local/squid/etc/cert.pem 

And for users can't view errors in browsers, install this as a root trusted in each computer or add into your Active Directory (google may help for this).

openssl x509 -in /usr/local/squid/etc/cert.pem -outform DER -out /usr/local/squid/etc/cert.der

Solution 2

As per the Squid FAQ:

Squid.conf ACLs

Header modification via Squid ACLs is limited to deleting a header or replacing a matching header with a constant string.

In other words, you won't be able to add arbitrary request headers simply by using Squid ACLs. The Squid ACLs limit you to deleting existing headers or replacing existing headers, but don't allow addition of new headers. The only way to add new headers is by making use of an ICAP server together with Squid. For more information, see the ICAP section in the Squid FAQ.

Solution 3

Using squid, you will:

1. Set up dyanmic SSL certificate generation. Install the root certificate in the web clients' browsers.
2. Set up SSL Bump to intercept proxied SSL/TLS traffic.
3. Use ACLs to insert your desired header(s).

Comments

[symcbean]

wiki.squid-cache.org/SquidFaq/ContentAdaptation

[chutz]

Well, this answer is no longer true.