Squid Kerberos fallback

JoeFromNowhere

Hello everyone !
I have Squid + Kerberos + Squidguard working with no problem.
But I would like it to work this way :
If Kerberos auth is not ok (client out of the domain for example), go on anyway ! It work with fallback to ntlm, asking for user/password through browser. But not asking for nothing.

Here the code :
auth_param negotiate program /usr/local/libexec/squid/negotiate_kerberos_auth -r -d -i -k /usr/local/etc/squid/squidproxy.keytab -s HTTP/proxt.local
auth_param negotiate children 1000
auth_param negotiate keep_alive on
acl auth proxy_auth REQUIRED
http_access allow auth
http_access allow all

With this code, connection is refused if computer is not in the domain. Any idea ?
(Pfsense and package are in the last version available.)

JoeFromNowhere

I realized I forgot to say what is the goal of this !
The goal is to log usernames is they are connected to the domain, and just let pass those who are not. But "http_access allow all" seems to ignored...