Welcome! Log In Create A New Profile

Advanced

Re: Satistfy any not working as expected

Maxim Dounin
May 19, 2015 03:18PM
Hello!

On Tue, May 19, 2015 at 02:20:39PM -0400, Arno0x0x wrote:

> Hi Maxim,
>
> Thanks for your answer. I'm actually using a proper URI in the auth_request
> parameter and the PHP script works fine
> (https://github.com/Arno0x/TwoFactorAuth), my example was dumb.
>
> For the records, here's what I did to make it work exactly as I expect:
> simply remove the "deny all;" statement.
>
> As a result :
> - Any local network IP gets a straight access
> - Any other IP has to go through the auth_request
>
> This makes sense to me as a "satisfy any" coupled with a "deny all;" would
> always match "all" and refuse access.
>
> Not sure why all configuration examples we can find on the web mention the
> "deny all;" statement, but this fails for me.

The "deny all;" statement shouldn't change anything. With "satisfy
any;" access is allowed as long as one of the modules allows
access, and restrictions imposed by other modules are ignored.

The idea is that you configure several independent access checks
and then combine them: either with AND ("satisfy all", all checks
have to succeed) or with OR ("satisfy any", any successful check
is sufficient).

Simple config for testing:

server {
listen 8080;

satisfy any;
deny all;
auth_request /auth;

location / {
# index.html expected under root
}

location = /auth {
return 204;
}
}

If removing "deny all;" works for you, it means that you are
testing something wrong. In particular, make sure that the config
you are testing is actually loaded, it does contain "satisfy
any", and it's not overwritten somewhere in locations.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

Satistfy any not working as expected

Arno0x0x May 18, 2015 04:48AM

Re: Satistfy any not working as expected

Maxim Dounin May 18, 2015 08:46AM

Re: Satistfy any not working as expected

Arno0x0x May 19, 2015 02:20PM

Re: Satistfy any not working as expected

Maxim Dounin May 19, 2015 03:18PM

Re: Satistfy any not working as expected

Arno0x0x May 20, 2015 01:12PM

Re: Satistfy any not working as expected

Maxim Dounin May 20, 2015 02:46PM

Re: Satistfy any not working as expected

Arno0x0x May 20, 2015 03:00PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 67
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready