# LDAP Auth only for external addresses

**URL:** <https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201>\
**Category:** NGINX\
**Created:** [September 10, 2013, 11:34am UTC](https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201 "2013-09-10T11:34:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [September 10, 2013, 11:34am UTC](https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201/1 "2013-09-10T11:34:46Z")

</div>

Hi,  
I configured a nginx 1.5.4 server with the ngnix-auth-ldap module. It  
works all fine, but im looking for an option to distinguish the client  
networks. My goal is, that users from the network 10._._.\* and 172._._.\*  
don’t have to authenticate as all the others.  
Is that possible ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Matthias\_Sidler](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/898d66/32.png) [@Matthias\_Sidler](https://www.ruby-forum.com/u/Matthias_Sidler)\
**Post date:** [September 10, 2013, 6:55pm UTC](https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201/2 "2013-09-10T18:55:13Z")

</div>

On Tue, Sep 10, 2013 at 11:34:01AM +0200, Matthias Sidler wrote:

Hi there,

Untested, but…

> I configured a nginx 1.5.4 server with the ngnix-auth-ldap module. It works all  
> fine, but im looking for an option to distinguish the client networks. My goal is,  
> that users from the network 10._._.\* and 172._._.\* don’t have to authenticate as  
> all the others.  
> Is that possible ?

I’d expect “satisfy any” to be involved in the solution –

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#satisfy)**
>
> This directive appeared in version 1.11.8.

Do the notes at ["satisfy any;" does not work with "allow/deny" and "auth\_ldap" · Issue #7 · kvspb/nginx-auth-ldap · GitHub](https://github.com/kvspb/nginx-auth-ldap/issues/7) help  
at all? I don’t know which specific versions of code you’re using;  
possibly newer versions don’t need any workarounds.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Matthias\_Sidler](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/898d66/32.png) [@Matthias\_Sidler](https://www.ruby-forum.com/u/Matthias_Sidler)\
**Post date:** [September 11, 2013, 9:21am UTC](https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201/3 "2013-09-11T09:21:30Z")

</div>

Thanks alot!

That works for me:

[…]  
location / {  
satisfy any;

```
    auth_ldap "Forbidden";
    auth_ldap_servers myldap;

    auth_basic "Forbidden";

    allow 10.0.0.0/8;
    allow 172.0.0.0/8;
    deny all;
}

```

[…]

* * *

Mat

---

<div class="post-metadata">

**Author:** ![Matthias\_Sidler](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/898d66/32.png) [@Matthias\_Sidler](https://www.ruby-forum.com/u/Matthias_Sidler)\
**Post date:** [September 11, 2013, 2:46pm UTC](https://www.ruby-forum.com/t/ldap-auth-only-for-external-addresses/246201/4 "2013-09-11T14:46:51Z")

</div>

On Wed, Sep 11, 2013 at 09:20:58AM +0200, Matthias Sidler wrote:

Hi there,

> That works for me:

Good to hear.

Having the answer included on the list like this should also help the  
next person with the same issue.

Cheers,

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)