aaa.policy.handler.@pre-authorization

@pre_authorization

Variant of @pre_execute for @authorization which is only executed for authorization requests. If this pipeline rejects, the main @authorization and @post_authorization pipelines are skipped, and the request is rejected immediately.

Note: The @ prefix is required for pipeline blocks. The legacy syntax without @ (e.g., pre_authorization {}) is deprecated and emits warnings. Use @pre_authorization {} for new configurations.

See also

• Execution context - Available variables
• Execution pipelines - Pipeline actions and control flow
• until - Control flow

Example

@pre_authorization {
    backend "LDAP_DIRECTORY";
    if all {
        user.group == "banned";
    } then {
        reject;
    }
}