allow doesn't stop when matching - since at least nginx 1.18 - ngx_http_access_module

[bezio@…]

We do have some nginx-based balancer which does ssl-offloading and upstreaming via proxy_pass to our web-nodes.
Some applications are only accessible out of the datacenter and from well-known ip-addresses which we allowed them by allow (here-in I stripped/normalized that quite a bit). For people who work out of homeoffice we also enabled ldap-authentication based on auth_pam.
The mentioned application has own authentication implemented so we passthrough the simpleauth.

All worked fine using nginx 1.16 - since 1.18 (reproduced with 1.19, too) we see errors reaching our error.log but still the site + authentication works flawless.

Config

is attached as output of nginx -T. Here is our used "allow-settings":

Within the server-context we include a file containing:

# LDAP/ou=Web-Access/postoffice
satisfy any;

allow 10.0.0.0/8;
allow 127.0.0.1;

# Access against the ldap
auth_pam "Staff Area";
auth_pam_service_name "nginx.stgtest";

deny all;

Error as seen in log:

2020/11/23 11:22:37 [error] 18300#18300: *17 PAM: user 'postoffice' - not authenticated: User not known to the underlying authentication module, client: 127.0.0.1, server: postoffice.test.me, request: "HEAD /v1/post/2307fae3-c43f-4d3a-b5b2-419646e1abcf?encoding=base64 HTTP/2.0", host: "postoffice.test.me"

Expected behaviour

Normally, as I understand ​http://nginx.org/en/docs/http/ngx_http_access_module.html#allow
saying The rules are checked in sequence until the first match is found. the directive allow 127.0.0.1; should stop the sequence and we do not see any access towards auth_pam.

[bezio@…]

output as of nginx -T

[Maxim Dounin]

The error is generated by the 3rd party auth_pam module you are using, which is checked before the access module. Once the control reaches the access module, matching stops at allow 127.0.0.1; as documented.

The "all worked fine" part is likely due to ​this commit in the auth_pam module, which changes its logging.

[bezio@…]

Thanks a lot for pointing this out! I checked the changelog of nginx but not of the module, my bad.

Nethtertheless from my point of view the fall-through type of execution is broken as I expect the first matched allow to stop nginx from requesting the auth_pam_module. But we will deal with the actual situation.

[Maxim Dounin]

Nethtertheless from my point of view the fall-through type of execution is broken as I expect the first matched allow to stop nginx from requesting the auth_pam_module.

This can be achieved by the auth_pam module: it needs to put itself after the access module in the access phase. As long as the module is compiled dynamically, it should be easy enough, by using appropriate ngx_module_order.