# Support for \<RequireAll\> sections in ood\_portal.yml auth: block

**URL:** <https://discourse.openondemand.org/t/support-for-requireall-sections-in-ood-portal-yml-auth-block/3024>\
**Category:** Feature Requests and Roadmap Discussion\
**Created:** [October 17, 2023, 12:52am UTC](https://discourse.openondemand.org/t/support-for-requireall-sections-in-ood-portal-yml-auth-block/3024 "2023-10-17T00:52:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kilian](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kilian/32/61_2.png) [@kilian](https://discourse.openondemand.org/u/kilian)\
**Post date:** [October 17, 2023, 12:52am UTC](https://discourse.openondemand.org/t/support-for-requireall-sections-in-ood-portal-yml-auth-block/3024/1 "2023-10-17T00:52:54Z")

</div>

Hi!

I was wondering if generating `<RequireAll>` sections was something that is currently supported (or planned) in the OOD portal generator.

Right now, the `auth:` section takes things like:

```auto
auth:
  - "AuthType openid-connect"
  - "Require claim group:foo"

```

and transforms them in the following Apache configuration block:

```auto
  <Location "/oidc">
    AuthType openid-connect
    Require claim group:foo
  </Location>

```

But in some configurations, it may be necessary to check and require multiple claims, and make sure they’re all satisfied, using the `<RequireAll>` directive. For instance, to check that users are members of multiple groups, like this:

```auto
<Location "/oidc"> 
  <RequireAll>
    AuthType openid-connect 
    Require claim group:foo
    Require claim group:bar
  </RequireAll>    
</Location>

```

Is that something that the OOD portal generator can do?

Thanks!

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [October 17, 2023, 11:21am UTC](https://discourse.openondemand.org/t/support-for-requireall-sections-in-ood-portal-yml-auth-block/3024/2 "2023-10-17T11:21:38Z")

</div>

The logic for the auth lines is to iterate over the items in `auth` and write them out: [https://github.com/OSC/ondemand/blob/c2aa53db187b90f67d1ec179af853d144f5e64c9/ood-portal-generator/templates/ood-portal.conf.erb#L218-L220](https://github.com/OSC/ondemand/blob/c2aa53db187b90f67d1ec179af853d144f5e64c9/ood-portal-generator/templates/ood-portal.conf.erb#L218-L220)

This should give you the desired result:

```auto
auth:
  - '<RequireAll>'
  - ' AuthType openid-connect',
  - ' ...etc...'
  - '</RequireAll>'

```

---

<div class="post-metadata">

**Author:** ![kilian](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kilian/32/61_2.png) [@kilian](https://discourse.openondemand.org/u/kilian)\
**Post date:** [October 17, 2023, 3:03pm UTC](https://discourse.openondemand.org/t/support-for-requireall-sections-in-ood-portal-yml-auth-block/3024/3 "2023-10-17T15:03:04Z")

</div>

Ah but of course, thanks for pointing this out. 😃  
This works great, thank you!