Index: src/cf.data.pre
===================================================================
RCS file: /cvsroot/squid/squid/src/cf.data.pre,v
retrieving revision 1.450.2.33
diff -u -u -r1.450.2.33 cf.data.pre
--- src/cf.data.pre	16 Aug 2009 21:52:42 -0000	1.450.2.33
+++ src/cf.data.pre	15 Sep 2009 04:44:47 -0000
@@ -5703,5 +5703,21 @@
 	Note: after changing this, Squid service must be restarted.
 DOC_END
 
+NAME: auth_required_on_auth_acl_deny
+COMMENT: on|off
+TYPE: onoff
+DEFAULT: on
+LOC: Config.onoff.auth_required_on_auth_acl_deny
+DOC_START
+	By default, Squid will try to re-authenticate a user if the request matches
+	on an ACL -deny- which somehow required an ACL authentication. This matches
+	anything which returns true from acl.c:aclIsProxyAuth() - specifically
+	the ACL types "auth", "auth_regex" and "external" where the external ACL
+	requires the authentication details.
+
+	This option allows the resulting reply to just return "authentication
+	denied" returning "proxy auth required". This will prevent further ACL
+	authentication popups from occuring.
+DOC_END
 
 EOF
Index: src/client_side.c
===================================================================
RCS file: /cvsroot/squid/squid/src/client_side.c,v
retrieving revision 1.754.2.27
diff -u -u -r1.754.2.27 client_side.c
--- src/client_side.c	16 Aug 2009 21:43:51 -0000	1.754.2.27
+++ src/client_side.c	15 Sep 2009 04:44:47 -0000
@@ -469,7 +469,12 @@
 	http->redirect_state = REDIRECT_PENDING;
 	clientRedirectStart(http);
     } else {
-	int require_auth = (answer == ACCESS_REQ_PROXY_AUTH || aclIsProxyAuth(AclMatchedName)) && !http->request->flags.transparent;
+	int require_auth;
+	if (Config.onoff.auth_required_on_auth_acl_deny) {
+		require_auth = (answer == ACCESS_REQ_PROXY_AUTH || aclIsProxyAuth(AclMatchedName)) && !http->request->flags.transparent;
+	} else {
+		require_auth = (answer == ACCESS_REQ_PROXY_AUTH) && !http->request->flags.transparent;
+	}
 	debug(33, 5) ("Access Denied: %s\n", http->uri);
 	debug(33, 5) ("AclMatchedName = %s\n",
 	    AclMatchedName ? AclMatchedName : "<null>");
Index: src/structs.h
===================================================================
RCS file: /cvsroot/squid/squid/src/structs.h,v
retrieving revision 1.538.2.16
diff -u -u -r1.538.2.16 structs.h
--- src/structs.h	25 Sep 2008 02:33:37 -0000	1.538.2.16
+++ src/structs.h	15 Sep 2009 04:44:48 -0000
@@ -703,6 +703,7 @@
 	int update_headers;
 	int ignore_expect_100;
 	int WIN32_IpAddrChangeMonitor;
+	int auth_required_on_auth_acl_deny;
     } onoff;
     acl *aclList;
     struct {