As your proxy is designed to sit in front of many servers, suppose that is the case, except that you may even have 2 proxies out front for load and fault-tolerant reasons. Now as I think about it, there is a measure of benefit to making such a decision on the proxy itself, but in a really large proxy array centralized authentication on the back end would be worth tapping into. At this point, a back end server still needs to authenticate the request. 2 things can happen. I am not quite sure, how and when I am going to solve that problem.
Suggestions are welcome.
My preference leans toward a database driven approach for more reasons than just availability, flexibility, scale, accuracy and accounting. This is simple. The port has basically always to be 110, because it is the standard POP3 port and you don't want to force users to change that in their clients. IP numbers are scarce, so using IP numbers is no way of doing this really. It can be used if you have 3 or 4 IP numbers maybe, but this can never work for thousands of users.