To enable authentication, goto :menuselection:`Services->Web Proxy->Administration` then collapse "Forward Proxy" and
choose "Authentication Settings". Choose a method and apply settings.
..Note::
In order for authentication scheme's to work, users do need to exist in the firewall. You can either import them (when using ldap)
or make sure the same username exists locally to map groups too.
Installation
---------------------------
Installation of this plugin is rather easy, go to :menuselection:`System --> Firmware --> Plugins` and search for **os-OPNProxy**,
use the [+] button to install it.
Next go to :menuselection:`Services --> Web Proxy --> Access control` to start configuring polcies.
..Note::
Redis is required for this plugin to operate, when accessing the access control settings page for the first time you will be pointed to the correct
setting to enable it directly. (just enable and apply should be enough)
General
---------------------------
In order to utilise user/group based policies, the proxy needs to be able to inspect the traffic and know the identity of the
user.
Since most of the internet is being encrypted nowadays, you would need to enable some sort of ssl inspection in between.
When setting "Enable SSL inspection" in :menuselection:`Services -> Webproxy -> Administration -> Forward Proxy`
you are able to use a "man-in-the-middle" approach (where the proxy intercepts traffic and is able to filter it).
A disadvantage of this option is that your clients would need to trust the firewalls certificate (CA selected in "CA to use").
When enabled full paths can be filtered.
A bit lighter option would be to use SSL inspection with "Log SNI information only" enabled,
in which case the firewall would know which domain you are trying to visit, but can not inspect the content of the request (or response for that matter).
..Note::
When enabling "Log SNI information only", only domain based policies will be usable for SSL/TLS based requests.
The standard authentication options available in OPNsense apply, which can be configured in