You have to adjust the domain portion, but otherwise it's fine
I pasted it in regex 101 and it stated that there was not a match
1 reply
only paste the path
but doesnt it need the whole string with the domain or does authelia only match the path?
"The resources section doesn't match the entire URL, it only matches the path"
I literally said this right before you said "I pasted it in regex 101 and it stated that there was not a match"
I misread
so just
https://sabnzbd.domain.com/api?mode=get_config&apikey=d5f8132adf2c5baed2e97a3&output=json
if using CF at all you might actually be getting blocked by that
I would suggest using the trace log level when debugging why a rule is not working
and its VERY IMPORTANT to have that
^ there
Correct,
api([?\/].*)?$ matches /api?mode=get_config&apikey=d5f8132adf2c5baed2e97a3&output=json and it matches /randompath/thisisapi?mode=get_config&apikey=d5f8132adf2c5baed2e97a3&output=json
I'm relatively careful when I give people regex to match a URL, specifically because I can't guarantee an app doesn't have some other path that may match a badly formed regex pattern
default_policy: deny
rules:
- domain: "*"
policy: bypass
networks:
- 192.168.1.0/24
- domain:
- "*.domain.com"
- "domain.com"
policy: two_factor
- domain:
- 'radarr.domain.com'
resources:
- '^/api([?/].*)?$'
policy: bypass
- domain:
- 'sabnzbd.domain.com'
resources:
- '^/api([?/].*)?$'
policy: bypass
now I have this
so in his config he first has
policy: two_factor for ALL domains, that means the bypasses under it wont work right?
access_control:
default_policy: deny
rules:
- domain: "*"
policy: bypass
networks:
- 192.168.1.0/24
- domain:
- 'radarr.domain.com'
resources:
- '^/api([?/].*)?$'
policy: bypass
- domain:
- 'sabnzbd.domain.com'
resources:
- '^/api([?/].*)?$'
policy: bypass
- domain:
- "*.domain.com"
- "domain.com"
policy: two_factor
try that
It does, but if all your rules to override default behavior are before rules that indicate your default it should be fine. Let me check the actual rules one sec.
- domain: "*.domain.com"
policy: bypass
networks:
- 192.168.1.0/24
I'd do that one instead
The rule order looks fine to me
- domain:
- "*.domain.com"
- "domain.com"
policy: two_factor
Ok so i understood it right, it walks from top to bottom, first rules it matches => the one it takes
if it finds nothing => default_policy
- domain:
- "*.domain.com"
- "domain.com"
policy: two_factor
Yep, first rule that matches a request is applied.
Just like firewalls
access_control:
default_policy: two_factor
rules:
- domain: "*"
policy: bypass
networks:
- 192.168.1.0/24
- domain: radarr.domain.com
resources:
- '^/api([?/].*)?$'
policy: bypass
- domain: sabnzbd.domain.com
resources:
- '^/api([?/].*)?$'
policy: bypass