You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/ngx_header_path_auth.md
+39-26Lines changed: 39 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,10 +23,10 @@ See the [auth request module documentation](http://nginx.org/en/docs/http/ngx_ht
23
23
24
24
The **ngx\_header\_path\_auth** configuration file is in TOML format, and the following is a sample configuration file.
25
25
26
-
27
26
```ini
28
27
socket_type = "tcp"
29
28
socket_path = "127.0.0.1:9202"
29
+
#cache_seconds = 0
30
30
path_header = "X-Authz-Path"
31
31
user_header = "X-Forwarded-User"
32
32
@@ -43,38 +43,51 @@ default_right = "*/
43
43
44
44
Each parameter of the configuration file is as follows.
45
45
46
-
* **socket\_type** - Set this parameter to tcp(TCP socket) or unix(UNIX domain socket).
47
-
* **socket\_path** - Set the IP address and port number for tcp, and UNIX domain socket file path for unix.
48
-
* **path\_header** - A HTTP header that sets the path used for authorization processing. The default value is `X-Authz-Path`. In the appropriate place of the nginx configuration file, use `proxy_set_header` directive to set the HTTP header. (Eg `proxy_set_header X-Authz-Path $request_uri;`)
49
-
* **user\_header** - A HTTP header to set the user name. The default value is `X-Forwarded-User`. In the appropriate place of the nginx configuration file, use `proxy_set_header` directive to set the HTTP header. (Eg `proxy_set_header X-Forwarded-User $remote_user;`)
46
+
### Root part
47
+
48
+
| Parameter | Description |
49
+
| :--- | :--- |
50
+
| **socket\_type** | Set this parameter to tcp(TCP socket) or unix(UNIX domain socket). |
51
+
| **socket\_path** | Set the IP address and port number for tcp, and UNIX domain socket file path for unix. |
52
+
| **cache\_seconds** | The cache duration in seconds to pass to nginx. However, if its value is 0, it will not use the cache.<br>See [Authentication Cache Control](proxy_cache.md) for details.|
53
+
| **path\_header** | A HTTP header that sets the path used for authorization processing. The default value is `X-Authz-Path`. In the appropriate place of the nginx configuration file, use `proxy_set_header` directive to set the HTTP header. (Eg `proxy_set_header X-Authz-Path $request_uri;`) |
54
+
| **user\_header** | A HTTP header to set the user name. The default value is `X-Forwarded-User`. In the appropriate place of the nginx configuration file, use `proxy_set_header` directive to set the HTTP header. (Eg `proxy_set_header X-Forwarded-User $remote_user;`) |
55
+
56
+
### **\[authz\]** part
50
57
51
-
* \[authz\] part
52
-
* **user_map** - User name and group name mapping file. More on this in the "_**user\_map** file details_" section.
53
-
* **path\_pattern** - A regular expression that extracts the authorization judgment string from the path of the header specified by **path_header**. The extracted string is used for the key in **path\_right**. Use the `()` subexpression regular expression only once to specify the extraction location.
54
-
* **nomatch\_right** - Authorization rights when the **path\_pattern** regular expression is not matched. For more information on authorization rights, see "_Authorization rights details_" section.
55
-
* **default\_right** - Authorization rights when it matches the **path\_pattern**の regular expression and is not specified in **path\_right**. For more information on authorization rights, see "_Authorization rights details_".
56
-
* **path\_right** - Authorization rights map for each extracted string when matching **path\_pattern** regular expression. Specify the extraction string as the key. For more information on authorization rights, see "_Authorization rights details_" section.
58
+
| Parameter | Description |
59
+
| :--- | :--- |
60
+
| **user\_map\_config** | A file that specifies how user names and group names are handled in **user\_map**. More on this in the "_**user\_map\_config** file details_" section. |
61
+
| **user_map** | User name and group name mapping file. More on this in the "_**user\_map** file details_" section. |
62
+
| **path\_pattern** | A regular expression that extracts the authorization judgment string from the path of the header specified by **path\_header**. The extracted string is used for the key in **path\_right**. Use the `()` subexpression regular expression only once to specify the extraction location. |
63
+
| **nomatch\_right** | Authorization rights when the **path\_pattern** regular expression is not matched. For more information on authorization rights, see "_Authorization rights details_" section. |
64
+
| **default\_right** | Authorization rights when it matches the **path\_pattern**の regular expression and is not specified in **path\_right**. For more information on authorization rights, see "_Authorization rights details_". |
65
+
| **path\_right** | Authorization rights map for each extracted string when matching **path\_pattern** regular expression. Specify the extraction string as the key. For more information on authorization rights, see "_Authorization rights details_" section. |
57
66
58
67
## Authorization rights details
59
68
60
-
In \[authz\] part, **nomatch\_right**, **default\_right**, and **path\_right** table value specify a character string that combines the following judgment descriptions with `|`. The combined judgment process is calculated by logical disjunction("OR"). If the result is true, it is authorized.
69
+
In **\[authz\]** part, **nomatch\_right**, **default\_right**, and **path\_right** table value specify a character string that combines the following judgment descriptions with `|`. The combined judgment process is calculated by logical disjunction("OR"). If the result is true, it is authorized.
61
70
62
-
* '' - (empty string) Always considers true regardless of the user name.
63
-
* '!' - Always considers false regardless of the user name.
64
-
* '*' - If the user name exists, it is considered true.
65
-
* '@groupname` - The character string after @ is treated as a group name. True if the group contains users. Groups are defined in the **user_map** file.
66
-
* '@' - (no group name) True if the user is described in the **user_map** file.
67
-
* 'username` True if the user name matches.
71
+
| Authorization method | Description|
72
+
| :--- | :--- |
73
+
| empty string | Always considers true regardless of the user name. |
74
+
| `!` | Always considers false regardless of the user name. |
75
+
| `*` | If the user name exists, it is considered true. |
76
+
| `@groupname` | The character string after @ is treated as a group name. True if the group contains users. Groups are defined in the **user_map** file. |
77
+
| `@` (no group name) | True if the user is described in the **user_map** file. |
78
+
| user name | True if the user name matches. |
68
79
69
-
## **user\_map** file details
80
+
## **user\_map\_config** file details
70
81
71
-
**user\_map** is a text file that defines users and groups.
72
-
This text file defines a user-group mapping, with a user name and group names (None or more is possible) on each line, as shown below.
82
+
**user\_map\_config** is a file that defines the handling of user names and group names.
83
+
This text file defines the available usernames and group names in regular expressions, as shown below.
73
84
74
-
``` plaintext
75
-
user1:group1 group2 ...
76
-
...
85
+
```
86
+
user_regex = '^[a-z_][0-9a-z_\-]{0,32}$'
87
+
group_regex = '^[a-z_][0-9a-z_\-]{0,32}$'
77
88
```
78
89
79
-
Separate the user name and group name with `:`. If there are multiple group names, separate them with ` ` (space character).
80
-
90
+
| Parameter| Description|
91
+
| :--- | :--- |
92
+
| **user\_regex** | A regular expression of strings to allow as usernames. |
93
+
| **group\_regex** | Regular expression of strings to allow as group names. |
Copy file name to clipboardExpand all lines: docs/ngx_ldap_auth.md
+18-12Lines changed: 18 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ On error, the process terminates with an unsuccessful status.
9
9
## How to start
10
10
11
11
Run it on the command line like this:
12
-
12
+
[ngx_header_path_auth](ngx_header_path_auth.md)
13
13
```
14
14
ngx_ldap_auth <config file>
15
15
```
@@ -28,6 +28,8 @@ The **ngx\_ldap\_auth** configuration file is in TOML format, and the following
28
28
```ini
29
29
socket_type = "tcp"
30
30
socket_path = "127.0.0.1:9200"
31
+
#cache_seconds = 0
32
+
#use_etag = true
31
33
auth_realm = "TEST Authentication"
32
34
33
35
host_url = "ldaps://ldap.example.com"
@@ -45,14 +47,18 @@ timeout = 5000
45
47
46
48
Each parameter of the configuration file is as follows.
47
49
48
-
***socket\_type** - Set this parameter to tcp(TCP socket) or unix(UNIX domain socket).
49
-
***socket\_path** - Set the IP address and port number for tcp, and UNIX domain socket file path for unix.
50
-
***auth\_realm** - HTTP realm string.
51
-
***host\_url** - The URL of the LDAP server connection address. The pass part is not used.
52
-
***start\_tls** - Set to 1 when using TLS STARTTLS.
53
-
***skip\_cert\_verify** - Set to 1 to ignore the certificate check result.
54
-
***root\_ca\_files** - A list of PEM files for the CA certificate. Used when the LDAP server is using a certificate from a private CA.
55
-
***base\_dn** - The base DN when connecting to the LDAP server.
56
-
***bind\_dn** - This is the bind DN when performing LDAP bind processing. Rewrite `%s` as the remote user name and `%%` as `%`.
57
-
***uniq\_filter** - Only if this value is set, search with this value filter. If the search result is one DN, the authentication will be successful.
58
-
***timeout** - Communication timeout(unit: ms) with the LDAP server.
50
+
| Parameter | Description |
51
+
| :--- | :--- |
52
+
|**socket\_type**| Set this parameter to tcp(TCP socket) or unix(UNIX domain socket). |
53
+
|**socket\_path**| Set the IP address and port number for tcp, and UNIX domain socket file path for unix. |
54
+
|**cache\_seconds**| The cache duration in seconds to pass to nginx. However, if its value is 0, it will not use the cache.<br>See [Authentication Cache Control](proxy_cache.md) for details.|
55
+
|**use_etag**| Set to `true` to enable cache validation using `ETag` tags.<br>See [Authentication Cache Control](proxy_cache.md) for details.|
56
+
|**auth\_realm**| HTTP realm string. |
57
+
|**host\_url**| The URL of the LDAP server connection address. The pass part is not used. |
58
+
|**start\_tls**| Set to 1 when using TLS STARTTLS. |
59
+
|**skip\_cert\_verify**| Set to 1 to ignore the certificate check result. |
60
+
|**root\_ca\_files**| A list of PEM files for the CA certificate. Used when the LDAP server is using a certificate from a private CA. |
61
+
|**base\_dn**| The base DN when connecting to the LDAP server. |
62
+
|**bind\_dn**| This is the bind DN when performing LDAP bind processing. Rewrite `%s` as the remote user name and `%%` as `%`. |
63
+
|**uniq\_filter**| Only if this value is set, search with this value filter. If the search result is one DN, the authentication will be successful. |
64
+
|**timeout**| Communication timeout(unit: ms) with the LDAP server. |
0 commit comments