Office365 NTLM authentication

Run local GP on W7 (don't remember but in the 2000 and 2003 it is gpedit.msc). Look for local machine policy-> computer config->windows setting->local policies->security option->Network security: LAN Manager authentication level

Set LM & NTLM - Use NTLMv2 session if negotited

I think what you ask is very relative to How to configure apache to basic authentication or allow when ntlm while proxying?. In particular, if you want to authenticate both to proxy, and then to remote site, it is not possible (unless client uses CONNECT).

If your situation is that you don't want to authenticate to Squid, but only to remote site, then I think Squid is somehow doing the right thing: once the resource you have fetched by authenticating yourself is in cache, it is now available also for non-authenticated requests for other clients. More precisely, have a look at this flow:

• User A has requested the resource /index.html on some that.server.com and provided the authentication information.
• Server returned HTTP status 200 and Squid has cached the resource /index.html.
• Now user B has requested the same resource and has provided no authentication information / or has provided some authenticated information.

Possible scenarios:

• Squid returns /index.html to user B from cache. This is wrong, as only server knows which users have access to which resources.
• Squid also tries to cache the authentication information together with /index.html. For basic authentication Squid can capture the username. Other mechanisms (NTLM/Kerberos) send only hashes over HTTP, so there is no way to learn the username.
• Squid never caches /index.html.