# Can http\_auth\_group() be executed only when an acl is true

**URL:** <https://discourse.haproxy.org/t/can-http-auth-group-be-executed-only-when-an-acl-is-true/3441>\
**Category:** Help!\
**Created:** [January 29, 2019, 3:08am UTC](https://discourse.haproxy.org/t/can-http-auth-group-be-executed-only-when-an-acl-is-true/3441 "2019-01-29T03:08:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kuma](https://avatars.discourse-cdn.com/v4/letter/k/a587f6/32.png) [@kuma](https://discourse.haproxy.org/u/kuma)\
**Post date:** [January 29, 2019, 3:08am UTC](https://discourse.haproxy.org/t/can-http-auth-group-be-executed-only-when-an-acl-is-true/3441/1 "2019-01-29T03:08:16Z")

</div>

Here is my relevant configuration to authenticate/authorize service requests -

> global  
> …  
> userlist myusers  
> group u\_svc1 users a,b  
> group u\_svc2 users c  
> user a password hashedpwda  
> user b password hashedpwdb  
> user c password hashedpwdc
> 
> listen http-in  
> mode http  
> acl **svc1flag** hdr\_sub(service) “svc1”  
> acl svc1auth http\_auth\_group(myusers) u\_svc1 **if svc1flag**  
> use\_backend …
> 
> acl **svc2flag** hdr\_sub(service) “svc2”  
> acl svc2auth http\_auth\_group(myusers) u\_svc2 **if svc2flag**  
> use\_backend …  
> …

when i start, i get following errors -

> invalid group if  
> invalid group svc1flag  
> invalid group if  
> invalid group svc2flag  
> …

If i remove ( **if svc1flag/if svc2flag/…** ) from http\_auth\_group lines like below, everything works fine -

> acl svc1auth http\_auth\_group(myusers) u\_svc1  
> acl svc2auth http\_auth\_group(myusers) u\_svc2

But i want to keep (if svc1flag) this condition otherwise i will be running http\_auth\_group() acl for every service configuration until i find the matching service.

Any way to address it?

Thanks

---

<div class="post-metadata">

**Author:** ![kuma](https://avatars.discourse-cdn.com/v4/letter/k/a587f6/32.png) [@kuma](https://discourse.haproxy.org/u/kuma)\
**Post date:** [February 6, 2019, 9:07pm UTC](https://discourse.haproxy.org/t/can-http-auth-group-be-executed-only-when-an-acl-is-true/3441/2 "2019-02-06T21:07:14Z")

</div>

Any plans to support acl check with http\_auth\_group() method calls conditional?  
 Ideally if should be treated as keyword instead of treating it as just another user group.