How does policy ordering work ? #9358
-
|
Hello, I am currently testing Authentik on my server and I really like it! I have been doing a bit of testing and there is some fundamental logic that I seem to miss. I followed the instructions at the bottom of this page https://docs.goauthentik.io/integrations/sources/google/ to do the username mapping and it works like a charm but, I am wondering what is going on when they are multiple policies conditioning a stage. I have here two policies with orders 0 and 1. Here is the corresponding diagram: I was expecting a "first matched" policy system, especially because I have selected "any" for the policy matching option in the stage binding, which I understand as: if the first policy doesn't match the second is tried, then the third, and so on. My tests seam to show that, because default-source-enrollment-if-username is "order 1", it appears to be never evaluated. Thank you in advance for those clarifications. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
You've probably figured this out by now, but I wanted to reply to this because I found your post while I was trying to figure out a similar problem. Your assumptions aren't that far off-- the two Policy Engine options change the behavior of the policy check. "Any" should execute the stage if any single bound, enabled policy matches, while "All" should execute the stage only if every bound, enabled policy matches. The problem is that they're .. mislabeled. Currently (June 12, 2024), if you want the "any" behavior, you have to select "all," and vice versa. Hope this helps! |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for those clarifications ;) |
Beta Was this translation helpful? Give feedback.
You've probably figured this out by now, but I wanted to reply to this because I found your post while I was trying to figure out a similar problem.
Your assumptions aren't that far off-- the two Policy Engine options change the behavior of the policy check. "Any" should execute the stage if any single bound, enabled policy matches, while "All" should execute the stage only if every bound, enabled policy matches.
The problem is that they're .. mislabeled. Currently (June 12, 2024), if you want the "any" behavior, you have to select "all," and vice versa.
Hope this helps!