Preventing authentication errors for forward proxy clients

Why proxy authentication errors occur

When a proxy-cache server is operating in transparent mode, Web browsers and media players do not normally have the host name of that proxy-cache server in their proxy settings configuration. When a Web browser or media player is not aware of the existence of a proxy-cache server and it receives a proxy authentication request, it displays an error message and does not prompt the user for a password.

NetCache solution for authentication and transparent proxying

Network Appliance has designed an authentication scheme for HTTP transparent proxying. This authentication scheme does not conform to the HTTP 1.1 specification. If you enable this feature, NetCache violates the HTTP specification because it inserts and strips 401 authentication requests.

To access the NetCache HTTP Transparent-Mode Authentication option, select Setup tab > Authentication > General.

Important considerations for determining whether to use HTTP authentication with transparency

Consider the following when determining whether to use authentication for transparent proxying:

If IP addresses do not form a one-to-one association with users or computers
If you expect access to occur through an address translation device or through multiple Web browsers on a compute server, users trying to authenticate simultaneously might obtain shared privileges, might never be prompted, or both.
When the IP address in the cache expires (for a previously authenticated client) and a user requests 401 (unauthorized) protected content from an origin server, an end user might be prompted for multiple credentials consecutively, if the request is for a site that also requires HTTP-based authentication.

How the NetCache authentication scheme works

NetCache inserts 401 (unauthorized) requests into transparent proxy requests to obtain an authentication credential from a Web browser. The Web browser sends the credential until the user accesses another site. NetCache caches the IP addresses of clients so that it can determine which clients have been authenticated to use the appliance and determine the credentials that the clients used. IP addresses in the cache expire after a period of time that you can configure.

Note
For Web accelerators, the appliance does not need to cache client IP addresses. When the appliance is deployed as a Web accelerator, it represents the Web site to be authenticated.