From 59ef5fd1dfc91d27e71aea7636be88302c56834a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Golembiovsk=C3=BD?= <nyoxi@nyoxi.net>
Date: Mon, 9 Sep 2013 18:50:07 +0200
Subject: [PATCH] bugfix: User gets authenticated when satisfy is 'any' and no
 group matches.

---
 ngx_http_auth_ldap_module.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ngx_http_auth_ldap_module.c b/ngx_http_auth_ldap_module.c
index bf2f455..0684451 100644
--- a/ngx_http_auth_ldap_module.c
+++ b/ngx_http_auth_ldap_module.c
@@ -1807,7 +1807,12 @@ ngx_http_auth_ldap_check_group(ngx_http_request_t *r, ngx_http_auth_ldap_ctx_t *
 
     /* Check next group */
     if (ctx->iteration >= ctx->server->require_group->nelts) {
-        return NGX_OK;
+        /* No more groups */
+        if (ctx->server->satisfy_all == 0) {
+            return NGX_DECLINED;
+        } else {
+            return NGX_OK;
+        }
     }
 
     if (!ngx_http_auth_ldap_get_connection(ctx)) {