<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi<br>
<br>
<br>
Months ago I was trying to setup a nginx-CAS environment and found
this issue (I'll explain below). Now, I have found it again, but
this time seems not so easy to workaround.<br>
<br>
Scenario:<br>
Client connects to Apache which forwards to Apereo CAS server and
authenticate the user.<br>
Once authenticated, Apache reverse proxy NGINX with a http header in
the request which contains the list of groups the user is member of.<br>
<br>
To sum up: nginx knows the user, has a comma separated list of
groups, and the location the user requested to browse.<br>
<br>
<br>
In the past event, I had ~200 Group/URLs I wanted to protect, and
tried to:<br>
<blockquote><font face="Courier New, Courier, monospace" size="-1">map
$request_method:$http_groups:$request_uri $denied {</font><br>
<font face="Courier New, Courier, monospace" size="-1">
default 1;</font><br>
<font face="Courier New, Courier, monospace" size="-1">
~^GET:group$group:/$group 0;</font><br>
<font face="Courier New, Courier, monospace" size="-1">}</font><br>
</blockquote>
sadly, map does not expand the left side of the statement, so I
couldn't do that and ended doing:<br>
<blockquote><font face="Courier New, Courier, monospace" size="-1">map
$request_method:$http_groups:$request_uri $denied {</font><br>
<font face="Courier New, Courier, monospace" size="-1">
default 1;</font><br>
<font face="Courier New, Courier, monospace" size="-1">
~^GET:group1:/group1 0;</font><br>
<font face="Courier New, Courier, monospace" size="-1">
~^GET:group2:/group2 0;</font><br>
<font face="Courier New, Courier, monospace" size="-1"> ...</font><br>
<font face="Courier New, Courier, monospace" size="-1"> 200
lines</font><br>
<font face="Courier New, Courier, monospace" size="-1"> ...</font><br>
<font face="Courier New, Courier, monospace" size="-1">}</font><br>
</blockquote>
As previously said, today I'm having the same issue, but this time
the predefined group list is not known. Actually, a user creates a
"chat room" and only users from specified group list can join. <br>
<br>
As I could send this "new list" as a header to nginx: It is possible
to compare two nginx variables to check if "$a do not contain $b"?<br>
<br>
Actually I'm usin regex backreferences to solve it. eg:
$tmp="$var1:$var2" and $tmp ~ "(.*):\1"<br>
<br>
Regards.
</body>
</html>