[lenaing]

Hello there,

This PR intends to fix proxy requiring authentication usage and wrong documentation about it.

I could not find a way to use proxy requiring an authentication with preemptive authentication enabled, even in a simple out-of-this-PR context.

Java is not my main language so there may be a more elegant / efficient way to fix this issue.

Kind regards,

Tested against both authenticated and unauthenticaded Squid

mysquid.conf

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 24 hours
auth_param basic casesensitive off
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all
dns_v4_first on
forwarded_for delete
via off
http_port 3128

Running the Squids

docker run -e TZ=UTC -p 3129:3128 ubuntu/squid:5.2-22.04_beta
docker run -e TZ=UTC -v /path/to/mysquid.conf:/etc/squid/squid.conf -v /path/to/mysquidpasswords:/etc/squid/passwords -p 3128:3128 ubuntu/squid:5.2-22.04_beta

Tests

pipeline {
    agent any

    stages {
        stage('Test') {
            steps {
                // No proxy
                httpRequest url: 'https://httpbin.org/'
                httpRequest url: 'https://httpbin.org/basic-auth/user/passwd', authentication: 'httpbin'
                // Proxy without authentication
                httpRequest url: 'https://httpbin.org/', httpProxy: 'http://127.0.0.1:3129'
                httpRequest url: 'https://httpbin.org/basic-auth/user/passwd', authentication: 'httpbin', httpProxy: 'http://127.0.0.1:3129'
                // Proxy with authentication
                httpRequest url: 'https://httpbin.org/', httpProxy: 'http://127.0.0.1:3128',  proxyAuthentication: 'proxy-auth'
                httpRequest url: 'https://httpbin.org/basic-auth/user/passwd', authentication: 'httpbin', httpProxy: 'http://127.0.0.1:3128',  proxyAuthentication: 'proxy-auth'
            }
        }
    }
}

[henriduflot]

I think my issue is related. When I use the proxyAuthentication parameter, an Authorization: Basic xyz header is added to the request. The request is responded with a 407 Proxy Authentication Required.

After comparing with a curl --proxy --proxy-user, it seems that the Proxy-Authorization: Basic xyz header is required instead.

[h3nr1-d14z]

finally taking a proper look, sorry for the wait.

a lot changed under this PR: master moved to Apache HttpClient 5 (#197), which rewrote the whole auth flow your patch was fixing. I rebased the branch onto master (force-pushed, so your original commits are replaced) and ported what's still needed:

• your extra-credentials fix survives — that was the real bug: when both authentication and proxyAuthentication are set, addCredentials() stored the target credential under the proxy host scope, so the proxy got the wrong Basic creds and answered 407 forever. one line in CredentialBasicAuthentication.
• the preemptive-auth avoidance part isn't needed anymore: HttpClient 5 scopes preemptive proxy auth correctly on its own (verified with a fake authenticating proxy — proxyAuthentication on its own, with basic auth, and with useNtlm all send the right Proxy-Authorization now).
• the README corrections already landed separately.

I also added a socket-level fake authenticating proxy and regression tests for both configurations. Full build green, SpotBugs clean.

thanks for the Squid testing back when you opened this — it made checking the ported fix against the original report easy.

— h3nr1-d14z

[h3nr1-d14z]

ported and verified, see my comment above. the extra-credentials fix is the surviving core of the original PR, plus regression tests behind a fake authenticating proxy.