Squid proxy: authorize some site without authentication

I think what you ask is very relative to How to configure apache to basic authentication or allow when ntlm while proxying?. In particular, if you want to authenticate both to proxy, and then to remote site, it is not possible (unless client uses CONNECT).

If your situation is that you don't want to authenticate to Squid, but only to remote site, then I think Squid is somehow doing the right thing: once the resource you have fetched by authenticating yourself is in cache, it is now available also for non-authenticated requests for other clients. More precisely, have a look at this flow:

• User A has requested the resource /index.html on some that.server.com and provided the authentication information.
• Server returned HTTP status 200 and Squid has cached the resource /index.html.
• Now user B has requested the same resource and has provided no authentication information / or has provided some authenticated information.

Possible scenarios:

• Squid returns /index.html to user B from cache. This is wrong, as only server knows which users have access to which resources.
• Squid also tries to cache the authentication information together with /index.html. For basic authentication Squid can capture the username. Other mechanisms (NTLM/Kerberos) send only hashes over HTTP, so there is no way to learn the username.
• Squid never caches /index.html.

You simply need to check the authentication feature doc for squid which is available at

http://wiki.squid-cache.org/Features/Authentication

There are a number of authentication methods available with squid and everything is well documented in the above link. Go through it and choose the appropriate one for you.