Hello!

On Tue, May 19, 2015 at 02:20:39PM -0400, Arno0x0x wrote:

> Hi Maxim,
>
> Thanks for your answer. I'm actually using a proper URI in the auth_request
> parameter and the PHP script works fine
> (https://github.com/Arno0x/TwoFactorAuth), my example was dumb.
>
> For the records, here's what I did to make it work exactly as I expect:
> simply remove the "deny all;" statement.
>
> As a result :
> - Any local network IP gets a straight access
> - Any other IP has to go through the auth_request
>
> This makes sense to me as a "satisfy any" coupled with a "deny all;" would
> always match "all" and refuse access.
>
> Not sure why all configuration examples we can find on the web mention the
> "deny all;" statement, but this fails for me.

The "deny all;" statement shouldn't change anything. With "satisfy
any;" access is allowed as long as one of the modules allows
access, and restrictions imposed by other modules are ignored.

The idea is that you configure several independent access checks
and then combine them: either with AND ("satisfy all", all checks
have to succeed) or with OR ("satisfy any", any successful check
is sufficient).

Simple config for testing:

server {
listen 8080;

satisfy any;
deny all;
auth_request /auth;

location / {
# index.html expected under root
}

location = /auth {
return 204;
}
}

If removing "deny all;" works for you, it means that you are
testing something wrong. In particular, make sure that the config
you are testing is actually loaded, it does contain "satisfy
any", and it's not overwritten somewhere in locations.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx