question: Lock authentication to specific IP addresses

[Gunni]

I am using SAML auth with Entra ID/Azure AD, but I want to prevent anyone not on a specific IP (or multiple IPs/CIDRs) from trying to authenticate or access the webserver.

How can I do that?

Defense in depth.

I used to have something like

@blocked not remote_ip <ip1> <ip2> <ip3>
respond @blocked "Nope" 403

But then I added caddy-security and it stopped working. I can get exact config on Monday.

[greenpau]

@Gunni , not sure whether I understand the use case and how it is related to this plugin.

[Gunni]

Basically:

1. check if user in in access list
2. check saml/redirect user
3. forward request to reverse proxy

In that order. Again if i need to post config, i can do it on Monday.

[greenpau]

In that order. Again if i need to post config, i can do it on Monday.

@Gunni , let's see your config.

[Gunni]

Here it is: https://gist.github.com/Gunni/c00b0eab5115eed846e04b66dfa85662