Authelia: Unable to bypass on certain resources for domain

[modem7]

Hi guys,

I'm trying to do a bypass for netdata /api/v1, but struggling - I suspect it's an ID10T error.

I've attempted to follow #333 but no go.

My setup is as follows:

access_control:
  default_policy: deny
  rules:
    # Rules applied to everyone
    - domain: authelia.mydomain.com
      policy: bypass
    - domain: "*.mydomain.com"
      policy: two_factor
    - domain: "mydomain.com"
      policy: two_factor

    - domain: netdata.mydomain.com
      resources:
        - '^/api/v1/.*$'
      policy: bypass

Log file shows as:

today at 1:27 PM time="2020-08-09T13:27:52+01:00" level=info msg="Access to https://netdata.mydomain.com/api/v1/data?points=60&group=average&options=ms%7Cflip%7Cjsonwrap%7Cnonzero&after=-300&dimensions=i1_n4_r2&chart=ipmi.temperatures_c&_=1596976069375 is not authorized to user , redirecting to https://authelia.mydomain.com?rd=https%3A%2F%2Fnetdata.mydomain.com%2Fapi%2Fv1%2Fdata%3Fpoints%3D60%26group%3Daverage%26options%3Dms%257Cflip%257Cjsonwrap%257Cnonzero%26after%3D-300%26dimensions%3Di1_n4_r2%26chart%3Dipmi.temperatures_c%26_%3D1596976069375" method=GET path=/api/verify remote_ip=<myip>

Not quite sure how to have 2fa for netdata.mydomain.com but either bypass or one factor on /api/v1

[james-d-elliott]

Move the bypass rules to the top of the list. It's first rule matching applies. So in your case *.mydomain.com is matching and applying. You want the most specific rules first in most cases, wildcard rules should be a "last resort".

[modem7]

That's absolutely perfect! Works fantastically!

Thank you so much! I really appreciate it!

[james-d-elliott]

No worries, glad I could help.