Squid and Duplicate Usernames Across LDAP Directories

If two independent directories both contain alex, the proxy needs a directory choice before it checks a password. Trying A and then B hides that choice inside authentication failure and can confuse an unavailable directory with a rejected secret.

Two arrangements can make the identity explicit:

• Qualified login. A name such as [email protected] selects a fixed, administrator-defined directory through a dispatcher. Preserve the qualified identity for authorization and logging. Do not turn a client-supplied suffix into an arbitrary LDAP server address.
• Stable trusted request context. A listener or another supported context selects the directory. Define what happens when a person roams or uses another listener; network location is not personal identity.

Replicas of one directory are different: they share an identity namespace. Unrelated directories do not become replicas because both use LDAP.

Make Squid's credential-cache key agree with the helper's selection. The auth_param reference describes key_extras for passing extra context and including it in the cache key, including the case of identical names distinguished by listening port. The helper must understand the extended input, and the chosen macro must be available at that authentication stage.

Prefer stable context. A frequently changing client IP can multiply cache identities and change controls that expect one user identity.

Define unknown directory, unknown account, rejected password and unavailable directory separately. North's account must not silently become South's Alex when North is unavailable. Keep those outcomes distinguishable in logs without recording passwords.