# Suricata rule for user based authentication **URL:** \ **Category:** Rules\ **Tags:** community, rules, suricata\ **Created:** [April 18, 2024, 3:41pm UTC](https://forum.suricata.io/t/suricata-rule-for-user-based-authentication/4610 "2024-04-18T15:41:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![bkmis](https://avatars.discourse-cdn.com/v4/letter/b/53a042/32.png) [@bkmis](https://forum.suricata.io/u/bkmis)\ **Post date:** [April 18, 2024, 3:41pm UTC](https://forum.suricata.io/t/suricata-rule-for-user-based-authentication/4610/1 "2024-04-18T15:41:42Z")
Hi All, I’m new to Suricata, and I previously had a setup with a proxy that authenticated requests using usernames and passwords passed through Squid proxy. Now, we’ve transitioned to using AWS Network Firewall and Suricata rules to manage whitelisting. I’m looking to implement a Suricata rule to authenticate usernames and passwords, but I’m having trouble finding suitable content. Could you please provide some sample rules to address this scenario? I know AWS Network Firewall (i.e. rebadged Suricata) is not an HTTP Proxy so might not support HTTP layer Basic Authentication or similar methods. can advise a different approach to achieve this? ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [April 25, 2024, 6:21pm UTC](https://forum.suricata.io/t/suricata-rule-for-user-based-authentication/4610/2 "2024-04-25T18:21:15Z")
I would recommend to start with the official documentation and maybe focus at a second step on the rule keywords like [8. Suricata Rules — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/rules/index.html) but it would mostly depend on how the traffic looks like that you see at that point. Does Suricata see the username and password hash?