How to configure mod_proxy_ajp to give different permissions to different apps in one virtual host?

Question

On my server I have two tomcat applications: 'hidden' and 'open'. The hidden application should only be available for the local network 192.168.0.0. The open app should be available for all networks.

The Applications run on Tomcat 7.0.6 and the requests are forewarded from Apache 2.2.17 with mod_proxy_ajp. All this runs on a FreeBSD 8.2 server.

The Apache web server also handles the root website, which is static. There is no virtual host configured (only one host).

I havn't found any example configuration so far, so I just tried to combine two simple configurations:

ProxyRequests Off
ProxyPreserveHost On

<Proxy /hidden>
  Order Deny,Allow
  Deny from all
  Allow from 192.168
</Proxy>

<Proxy /open>
  Order Deny,Allow
  Allow from all
</Proxy>

ProxyPass /hidden ajp://localhost:8009/hidden/
ProxyPassReverse /hidden ajp://localhost:8009/hidden/

ProxyPass /open ajp://localhost:8009/open/
ProxyPassReverse /open ajp://localhost:8009/open/

With this configuration both applications are accessible from all networks. I already played with the Allow / Deny settings. This one seemed the most logical to me.

Does anybody have an idea what's wrong with my configuration?

Oli

Answer 1

The <Proxy> directive takes a full URL - since your virtualhost may have more than one of those, the directive is more suited to when you're using it as a full proxy.

Try changing your directives to <Location> blocks, that should apply the permissions in the way you want:

<Location /hidden>
  Order Deny,Allow
  Deny from all
  Allow from 192.168
</Proxy>

<Location /open>
  Order Deny,Allow
  Allow from all
</Proxy>