1

I am running NGINX 1.8.0 with nginx-auth-ldap. I have an application running at /app using auth_ldap for authentication/authorization. It works.

server {
    listen 80;
    ...
    location /app/ {
        auth_ldap "Restricted";
        auth_ldap_servers test;
        ...
    }
}

I would like to give access to an extra bot account to perform some automated maintenance (web API). I cannot create an LDAP account for bot for security reasons.

I tried to simultaneously use auth_ldap and auth_basic (with a single bot user for the latter) but any credentials result in a 401. Did I make a mistake, or is it simply not possible to get it to work this way?

server {
    listen 80;
    ...
    location /app/ {
        auth_ldap "Restricted";
        auth_ldap_servers test;
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htaccess
        ...
    }
}

If this can't work, would you have any other recommendation how to proceed?

Note: I tried to mirror the application with auth_basic at a different location. The access control works, but the app hardcodes its URL: responses from /app-auth-basic contain links back to /app. I have no control over the application so this does not appear to lead anywhere.

server {
    listen 80;
    ...
    location /app/ {
        auth_ldap "Restricted";
        auth_ldap_servers test;
        ...
    }
    location /app-auth-basic/ {
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htaccess
        ...
    }
}
0

You were almost correct but missing the satisfy directive:

server {
    listen 80;
    ...
    location /app/ {
        satisfy any;

        auth_ldap "Restricted LDAP";
        auth_ldap_servers test;

        auth_basic "Restricted htaccess";
        auth_basic_user_file /etc/nginx/.htaccess

        ...
    }
}

With this you will first be prompted by an auth dialog that says "Restricted LDAP" (that only accepts LDAP credentials). If you click cancel you will be prompted by another auth dialog that says "Restricted htaccess" (that only accepts users/passwords that are in your htaccess file). Note that the second dialog never appears if you already entered correct credentials in the first one.

Alternatively you can send htaccess credentials via http://user:pass@your-domain.com straight away to get in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.