Hello!

On Wed, May 20, 2015 at 01:12:26PM -0400, Arno0x0x wrote:

> Thanks again for your explanations, they make sense. So I've put back the
> "deny all;" statement. I get the 403 unauthorized message back. And there's
> indeed some good indication in the error log, showing that my auth_request
> script does the job, and then the login page returns the 403 status code.
>
> So I added an "allow all;" statement just on the login page which is the
> only one that needs to be reachable in any case.
>
> Let me paste a more real and complete example of my config (I hid some
> personal stuff), I hope this one makes sense:

[...]

> location = /twofactorauth/login/login.php {
> allow all;
> auth_request off;

[...]

> See the "allow all;" statement under the login.php location ? This make
> everyhting work as I expect, but I hope i makes sense.

Yes, this looks correct. Obviously enough you shouldn't restrict
access to the login page, and 403 is perfectly explained by the
fact that previously it was restricted due to "deny all;" at
server{} level.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx