How do I override Apache's Digest Authentication domain?

Question

I have passenger fronted by Apache. Am trying to have digest authentication for my URLs selectively. I have the following scenario.

1. Location / needs to be digest authenticated under realm Foo
2. Location /a does not need to be authenticated
3. Location /a/b needs to be digest authenticated under realm Bar

This is my config (more or less):

<Location />
 AuthName Foo
 AuthType Digest
 AuthDigestDomain /
 AuthUserFile /etc/apache2/foo_digest.users
 require valid-user
</Location>
<Location /a >
 Allow from all
 Satisfy Any
</Location>
<Location /a/b >
 AuthName Bar
 AuthType Digest
 AuthDigestDomain /a/b
 AuthUserFile /etc/apache2/bar_digest.users
 require valid-user
<Location>

Here is the outcome:

1. Location / is under digest authentication Foo
2. Location /a is not under any authentication
3. Location /a/b is also not under any authentication

Am fairly new to this. What am I doing wrong?

Answer 1

In the <Location /a/b> block, you need a Satisfy All to switch back to the default behavior for that location, otherwise it's using the Satisfy Any from <Location /a>, allowing all hosts that match the host-based Allow/Deny directives.