greenpau/caddy-security

question: Lock authentication to specific IP addresses

Opened this issue · 4 comments

Gunni commented

I am using SAML auth with Entra ID/Azure AD, but I want to prevent anyone not on a specific IP (or multiple IPs/CIDRs) from trying to authenticate or access the webserver.

How can I do that?

Defense in depth.

I used to have something like

@blocked not remote_ip <ip1> <ip2> <ip3>
respond @blocked "Nope" 403

But then I added caddy-security and it stopped working. I can get exact config on Monday.

greenpau commented

@Gunni , not sure whether I understand the use case and how it is related to this plugin.

Gunni commented

Basically:

  1. check if user in in access list
  2. check saml/redirect user
  3. forward request to reverse proxy

In that order. Again if i need to post config, i can do it on Monday.

greenpau commented

In that order. Again if i need to post config, i can do it on Monday.

@Gunni , let's see your config.