Conditional http auth

Server NGINX
1

Got this idea off IRC, but it looks like variables don’t expand:

set $realm “enter your password”;

if ($http_via ~* “.somehost.net”) {
set $realm off;
}

auth_basic $realm;
auth_basic_user_file /etc/nginx/confs/htpasswd.test;

Any ideas on how to do conditional auth?

auth_basic and such is not allowed under “if” … trying to figure out
some way to dynamically do this.

2

Hi,

On 03/12/2010 22:49, Michael S. wrote:

Any ideas on how to do conditional auth?

auth_basic and such is not allowed under “if” … trying to figure out
some way to dynamically do this.
I think if you put the if() inside the server rather than inside a
location it should work.

e.g.

server {

set $realm “enter your password”;

if ($http_via ~* “.somehost.net”) {

 set $realm off;

}

location / {
auth_basic $realm;
auth_basic_user_file /etc/nginx/confs/htpasswd.test;

}

…

Though I’ve not tested it.

Cheers,

Marcus.

3

On Fri, Dec 3, 2010 at 1:00 PM, Eugaia [email protected] wrote:

auth_basic $realm;

This is still the problem… auth_basic doesn’t seem to accept
variables. If so, my original post -should- work. It still relies on
that.

4

No, it shouldn’t.

You can jump to named location inside if statement, and change
authorization
configuration there.
2010 12 4 00:05 пользователь “Michael S.” [email protected]
написал:

5

I thought of that - care to show an example of what you mean in pseudo
config? The way I was thinking about it might be wrong.

6

On 03/12/2010 23:00, Eugaia wrote:

e.g.
location / {
auth_basic $realm;
auth_basic_user_file /etc/nginx/confs/htpasswd.test;

}

It appears that auth_basic doesn’t take variables, so this won’t work
anyway.

Marcus.

7

On Sat, Dec 4, 2010 at 4:49 AM, Michael S. [email protected]
wrote:

With the ngx_lua [1] module enabled, it’s trivial:

set_by_lua $realm ’
if string.match(ngx.var.http_via, “.somehost.net”) then
return “off”
else
return “enter your password”
end’;

auth_basic $realm;
auth_basic_user_file /etc/nginx/confs/htpasswd.test;

This should have great performance even if you’re using Lua :wink:

Cheers,
-agentzh

[1] Issues · openresty/lua-nginx-module · GitHub

8

On Fri, Dec 3, 2010 at 1:07 PM, Boris D. [email protected] wrote:

No, it shouldn’t.

You can jump to named location inside if statement, and change authorization
configuration there.

So are you saying something like

if ($http_via ~* “.somehost.net”) {
rewrite @protected permanent;
}

location @protected {
auth_basic etc.
}

wouldn’t I have to define the entire location / twice then? once
inside of that named location (because I need the entire base
location and such to be active, just behind auth)

9

Hi,

On 04/12/2010 13:18, agentzh wrote:

auth_basic_user_file /etc/nginx/confs/htpasswd.test;

This should have great performance even if you’re using Lua :wink:
I’ve not tested it, but I had a quick look at the code and it appears
that auth_basic doesn’t accept variables (yet), so regardless of the
setting mechanism, I don’t think it will work.

Adding variable support to auth_basic, though, could be useful it seems.

Cheers,

Marcus.

10

On Sat, Dec 4, 2010 at 7:18 PM, agentzh [email protected] wrote:

[1] Issues · openresty/lua-nginx-module · GitHub

Sorry, the link should be

https://github.com/chaoslawful/lua-nginx-module/

Cheers,
-agentzh

11

Igor - any way that this could be implemented? Variable expansion for
auth_basic? Or do you have any other ideas?

12

On Sat, Dec 4, 2010 at 7:41 AM, Eugaia [email protected] wrote:

I’ve not tested it, but I had a quick look at the code and it appears that
auth_basic doesn’t accept variables (yet), so regardless of the setting
mechanism, I don’t think it will work.

Adding variable support to auth_basic, though, could be useful it seems.

Since it isn’t important enough to compile in lua just for this, I
wouldn’t have really considered this an option anyway.

But yes, I believe you’re still right. It still all relies on nginx
allowing variables. That could be as simple as a two line patch or
could be complex. I don’t know?