<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">The quick question/answer from the Subject line:
if you are asking: how do I use a $variable in the "does this match" part
of a "map"; the answer is "you don't". $ is either a literal character
(in a string), or the end-of-string metacharacter (in a regex).</pre>
</blockquote>
Thank you for your clear and concise answer. I wouldn't summarize it
better, both question and answer.<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">(Your example suggests that your client will send a http header "Groups:
gfoo" if this request should be handled as if this user is in the group
gfoo. Perhaps you are using a special client configuration where that
is true?)</pre>
</blockquote>
We're using Apereo CAS. The "grouplist" header comes from a trusted
server after user successfully authenticated.<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">Is the "foo" in each of "group gfoo", "group adminfoo", "url foo" always
identical? As in: can simple pattern-matching work, or do you need an
extra mapping somewhere to tie the names together?</pre>
</blockquote>
Basically, users belongs to groups. Some groups have access to
certain operations (GET, PUT, POST, DELETE) on certain URLs.<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">Is the /page/bar here the same as the /page/bar in the "foo" section? Or
is the "bar" in /page/bar here the same as the "bar" in /content/bar here?
Possibly it does not matter; but if it does not matter it should probably
not be in the question.</pre>
</blockquote>
These were just examples (that seems to confuse more than help)
trying to detail the scenario:<br>
"There are rules to allow some groups to do specific actions on
certain URLs". eg:<br>
<ul>
<li>groupAll can GET on /asdf</li>
<li>groupFoo can POST on /foo</li>
<li>groupBar can POST on /bar<br>
(again, names and locatiosn are just examples)</li>
<li>groupBonus can DELETE on /foo<br>
</li>
</ul>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">These map directives look wrong to me.
It looks like you should have the $request_uri bit at the end of the
"match against this" expansion, since you presumably want /content/bar
and /content/bar/something both to match the same way.</pre>
</blockquote>
I was using .*, but your approach seems better.<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">And it's not clear to me why you have multiple "map" directives. One
that sets the single variable "$denied_group" looks like it should
be enough. One "default" line; two lines per "foo" or "bar". What am
I missing?</pre>
</blockquote>
Again, you're right.<br>
<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<blockquote type="cite">
<pre wrap=""> map $request_method:$request_uri:$http_groups $denied {
default 1;
~^GET:/content/$myvar:g$myvar 0;
~^POST:/content/$myvar:admin$myvar 0;
}
</pre>
</blockquote>
<pre wrap="">
That can't. You would need two lines per "myvar" value -- but since
you must have the list of myvar values somewhere, you should be able to
auto-generate these lines from that list.</pre>
</blockquote>
I didn't understand that.<br>
<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">If the problem is "lots of files", then you could concatenate them all
in to one file.</pre>
</blockquote>
A kitty just died somewhere.<br>
<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">From the question, it is not not clear to me whether a user in group gbar
should have any access at all to the server foo.domain.com. And it is
not clear to me whether there is anything else available below /content/
other than /content/foo/, in the server foo.domain.com.</pre>
</blockquote>
I'm sorry I wasn't able to be more clear.<br>
<br>
foo.domain.com GET on certain URLs should be allowed for gfoo,
gfoobar and gAdmin groups<br>
while POST on specific URLs, can be only executed by gfoo and gAdmin<br>
DELETE on some URLs only by gAdmin<br>
otherwise default is denied<br>
<br>
bar.domain.com share the "same" rules...the same way like
asdf.domain.com, qwerty.domain.com and iloveyou.docmain.com<br>
<br>
And here is it where I would like to use $variable, instead of
copying a bunch of rules for each domain.<br>
<br>
<blockquote cite="mid:20160723082819.GV12280@daoine.org" type="cite">
<pre wrap="">Would a configuration along the lines of
==
server {
location /content/ {
if ($denied_group) {
return 403 "Forbidden";
}
...
}
location ~ /page/bar/action...and ~10 locations more per server...
}
==
do what you want?</pre>
</blockquote>
No, as it doesn't include the method POST/GET part, neither the
groups allowed for each URL.<br>
<br>
Thanks a lot<br>
<br>
</body>
</html>