> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/flow-control/authcontroller.md).

# AuthController

Customisable authentication menu

## Introduction

The AuthController authenticator enforces configurable control mechanisms that can be applied at different stages of the authentication flow. It can be positioned either before or after user identification, depending on the defined control logic.

If the configured pipe returns a failure response, the authentication process is immediately terminated and the attempt is marked as failed.

## Configuration

{% hint style="info" %}
**Authenticator type:** *AuthController*
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>pipe_id</code></td><td>ID of the pipe responsible decision making.</td><td><code>N/A</code></td><td>true</td></tr><tr><td><code>exec_if</code></td><td>An expression that determines if the authenticator should be executed or not.</td><td><code>N/A</code></td><td>false</td></tr><tr><td><code>fail_location</code></td><td>Where to send user agent on failed auth validation.</td><td><code>N/A</code></td><td>false</td></tr><tr><td><code>failed_redirect</code></td><td>User-Agent redirection based on error response from pipe. See advanced redirection.</td><td><code>N/A</code></td><td>false</td></tr><tr><td><code>use_generic_error_page</code></td><td>If true, when no failed_redirect patterns are matched and no fail_location is set, a generic error page is shown. If false, the framework handles the error.</td><td><code>false</code></td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
    "id": "authz",
    "type": "AuthController",
    "config": {
        "base_path": "${globals.default_login_suffix}",
        "pipe_id": "validate",
        "exec_if": "exports.username == 'User123'",
        "fail_location": "https://fortifiedid.se",
        "failed_redirect": [
            {
                "pattern": ".*Missing input param 'idg'.*",
                "target": "https://www.idg.se"
            },
            {
                "pattern": ".*Missing input param 'sunet'.*",
                "target": "https://www.sunet.se"
            }
        ]
    }
}
```

{% endtab %}
{% endtabs %}

### Advanced redirection

Based on the error response returned from the pipe, the user-agent can be redirected using regex patterns. If no pattern matches, the fail\_location parameter is used as a fallback.

The fail\_location parameter is defined as an array of fail location objects. Upon a fail-response from the pipe, the array is evaluated in order, and the user-agent is redirected to the first matching location.”

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><pre><code>failed_redirect.pattern
</code></pre></td><td>Regex expression</td><td>N/A</td><td>true</td></tr><tr><td><pre><code>failed_redirect.target
</code></pre></td><td>If matched, where to send the user agent</td><td>N/A</td><td>true</td></tr><tr><td><pre><code>custom_identifier
</code></pre></td><td>Tag used for. event separation</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Logging

WEB\_100044("AuthController executed - authorized")

* IDENTIFIER (user trace id)
* CUSTOMER\_IDENTIFIER (if configured)
* SOURCE\_ADDRESS (ip of the remote session)
* AUTHENTICATOR\_ID (id + display\_name of authenticator)

WEB\_100045("AuthController executed - not authorized")

* IDENTIFIER (user trace id)
* CUSTOMER\_IDENTIFIER (if configured)
* SOURCE\_ADDRESS (ip of the remote session)
* AUTHENTICATOR\_ID (id + display\_name of authenticator)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/flow-control/authcontroller.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.