<div dir="ltr">Hello, Amos, Thanks for the information. Can you also tell me: 1. Is it possible to use a macro in the annotate_client ACL to copy HTTP request notes to a TCP connection? Something like: acl annotate_groups annotate_client groups=%{group}note 2. How do you think, should we process the "group" attribute at the connection state level as we do with the "clt_conn_tag"? I think this can be easily implemented in the UpdateRequestNotes() function (src/HttpRequest.cc) by simply copying and pasting a few lines of code:<div>void UpdateRequestNotes(ConnStateData *csd, HttpRequest &request, NotePairs const &helperNotes) { // Tag client connection if the helper responded with clt_conn_tag=tag or group=groups. const char *cltTag = "clt_conn_tag"; if (const char *connTag = helperNotes.findFirst(cltTag)) { if (csd) { csd->notes()->remove(cltTag); csd->notes()->add(cltTag, connTag); } } const char *group = "group"; if (const char *hlprGroup = helperNotes.findFirst(group)) { if (csd) { csd->notes()->remove(group); csd->notes()->add(group, hlprGroup); } } request.notes()->replaceOrAdd(&helperNotes); }</div></div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">вт, 3 мар. 2026 г. в 16:02, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz">squid3@treenet.co.nz</a>>: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 04/03/2026 01:06, Andrey K wrote: > Hello, > > I use negotiate_kerberos_auth helper and it sets the AD groups list in a > group annotation attribute. > It works well, but thisattributeis not availableinthe > subsequentrequestsinan ssl-bumpedconnection (it is available only in the > first CONNECT request). > Is it possible to make this attribute persistent in the current SSL > connection? I would like to use groups from this attribute to authorize > users using only "note"-type ACLs, no external helpers involved. Unfortunately Squid does not yet support ACLs using details directly from the tunnel's "parent" CONNECT transaction. You can use the annotate_client ACL type to mark the from-client TCP connection instead of the HTTP request. Just be aware these need to be manually configured and thus does not scale to large number of groups. HTH Amos _______________________________________________ squid-users mailing list <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a> <a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a> </blockquote></div>