# Why subpath didn't it work **URL:** \ **Category:** Support\ **Created:** [April 6, 2022, 1:35am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101 "2022-04-06T01:35:35Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![cfanbo](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cfanbo](https://discuss.pomerium.com/u/cfanbo)\ **Post date:** [April 6, 2022, 1:35am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/1 "2022-04-06T01:35:35Z")
## What happened? It has no effect for "subpath“ is this case, tom can still access other url paths? No usage documentation for subpath was found（ `http_path` and `http_method` ） ## What’s your environment like? pomerium 0.17.1 os: ubuntu 18.04 x64 ## What’s your config.yaml? ```auto - from: https://test.example.com pass_identity_headers: true to: http://127.0.0.1:8080 allowed_users: - tom - jack policy: - allow: and: - http_path: is: /test ``` ## What did you see in the logs? log is normal ---
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [April 7, 2022, 2:42pm UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/2 "2022-04-07T14:42:43Z")
Hi @cfanbo. It looks like you’re mixing the older “Policy” based config model with the new “Route” based model, where the policy is a sub-key of the route. You probably want to standardize on the [new model](https://www.pomerium.com/reference/#routes), which would look something like this: ```nohighlight routes: - from: https://test.example.com pass_identity_headers: true to: http://127.0.0.1:8080 policy: - allow: and: - http_path: is: /test or: - user: is: tom is: jack ``` ---
**Author:** ![cfanbo](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cfanbo](https://discuss.pomerium.com/u/cfanbo)\ **Post date:** [April 19, 2022, 10:16am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/3 "2022-04-19T10:16:34Z")
Is this feature only supported in the Enterprise edition? ---
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [April 20, 2022, 2:29am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/4 "2022-04-20T02:29:59Z")
Nope, the new route/policy format applies to the OSS Pomerium config. ---
**Author:** ![cfanbo](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cfanbo](https://discuss.pomerium.com/u/cfanbo)\ **Post date:** [April 23, 2022, 7:46am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/5 "2022-04-23T07:46:37Z")
> [@alex](#): > > OSS Pomerium config whiat is OSS Pomerium config? Where is the document？ ---
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [April 25, 2022, 2:39pm UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/6 "2022-04-25T14:39:03Z")
The config file location depends on how you installed Pomerium. For system services, it lives in `/etc/pomerium/config.yaml`. For docker installations it’s attached to the container at `/pomerium/config.yaml`. Each [install doc](https://www.pomerium.com/docs/install/) references the location. The [reference](https://www.pomerium.com/reference/) page I linked above has all the settings available in the config. It’s broken up into settings for each service (for those using [split service mode](https://www.pomerium.com/reference/#all-in-one-vs-split-service-mode), as well as the shared settings required by all config files. If you’re running in all-in-one mode, then there’s only a single file. ---
**Author:** ![cfanbo](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cfanbo](https://discuss.pomerium.com/u/cfanbo)\ **Post date:** [April 26, 2022, 9:06am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/7 "2022-04-26T09:06:54Z")
Only some users are allowed to access some specified directories. How should I set it? For example, only allow access path '/manager/ ’ and ‘/admin/’ for user tom or jack ` WHERE subpath IN ("/manager/", "/admin/") AND user IN ("tom", "jack")` ---
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [May 2, 2022, 7:28pm UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/8 "2022-05-02T19:28:20Z")
Set specific routes for each subpath with separate policies: [Settings | Pomerium](https://www.pomerium.com/reference/#prefix) ---
**Author:** ![cfanbo](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cfanbo](https://discuss.pomerium.com/u/cfanbo)\ **Post date:** [May 5, 2022, 2:06am UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/9 "2022-05-05T02:06:41Z")
is that so？ ```auto routes: - from: https://test.example.com pass_identity_headers: true to: http://127.0.0.1:8080 policy: - allow: or: - http_path: is: /manager - user: is: tom or: - http_path: is: /admin - user: is: tom or: - http_path: is: /manager - user: is: jack or: - http_path: is: /admin - user: is: jack ``` ---
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [May 5, 2022, 1:33pm UTC](https://discuss.pomerium.com/t/why-subpath-didnt-it-work/101/10 "2022-05-05T13:33:36Z")
Not sure if that will work or not, I haven’t tested a route like that. What you’ve got there is a single route with multiple policy rules based on path. The docs I referred you to cover making individual routes for paths that can then have individual policies applied.