I asked the AI and it came up with this solution:
Basic idea
- Identify ActiveSync requests by URL path /Microsoft-Server-ActiveSync.
- Use map on $remote_user to mark whitelisted users.
- In the ActiveSync location, deny all for non‑whitelisted users and only proxy_pass for allowed ones.
Example nginx config
In the http {} block (global, not inside a server):
# Map authenticated username to a flag
map $remote_user $eas_allowed {
default 0; # deny by default
user1@example.com 1; # whitelisted user
user2@example.com 1; # another whitelisted user
}
In your Exchange reverse‑proxy server {}:
server {
listen 443 ssl;
server_name mail.example.com;
# ... SSL, upstream, etc ...
# ActiveSync endpoint
location /Microsoft-Server-ActiveSync {
# make sure auth headers are passed so $remote_user is set
auth_basic "Exchange";
auth_basic_user_file /etc/nginx/htpasswd-exchange;
# block everyone except mapped users
if ($eas_allowed = 0) {
return 403;
}
proxy_pass https://exchange_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# other locations (OWA, EWS, etc.)
}
This setup denies ActiveSync to all accounts except those explicitly listed in the map, while still allowing the same users to use other protocols/paths you proxy normally. map is evaluated very efficiently and is the recommended way to branch on usernames or other variables in nginx.