How to make squid transparent but with AD authorization?

Question

linux

Tell me how to set up a proxy in transparent mode, but when a user tries to access the Internet, would it ask for authorization? That is, the proxy somehow redirects to a web page that requests an AD login and password. With the correct input, he lets him on the Internet and, in addition, imposes restrictions on LDAP groups. Can this be done?
I understand that transparent + authorization = not possible. But Kerio Control works this way. And IKS works
Well, or a more general question: if I distribute proxy settings to all office employees using domain policies, then how to make field employees outside the office work through their Internet, outside the proxy?

Answer 1

It is necessary to fence something like this, in order to get the functionality similar to Kerio: https://habrahabr.ru/post/140052/
Regarding the exit - I would configure the proxy not with politicians, but using WPAD .