Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to be able to do this:

<LocationMatch ^/secret/(.+?)>
  <Limit GET>
    Require group member
  <LimitExcept GET>
    Require group member
    Require group contributor

"Require group" lets you suggest lots of groups that are considered with an OR; I require some kind of AND. Satisfy all seems to only influence Require when used with Allow.

Is there a way of controlling group membership with Require/AND?

(I should point out that we are using Atlassian Crowd's Perl module as our group provider, so if it's possible to implement this in the handler, that would work too.)

share|improve this question
up vote 2 down vote accepted

This is a limitation of basic auth. It is basic :) Though this does not directly answer your question, I will offer that if you have an LDAP directory to manage people, you can do something like "Require Filter (|(memberof=group1DN)(memberof=group2DN))" from mod_authz_ldap which would pass if the user was a member of either of those groups. You have more control over it, but obviously that would require a lot more setup than the basic filter. A WHOLE lot more if you don't have users in LDAP.

share|improve this answer
Thanks, the answer I hit upon was to implement a "Require allgroups" in the Perl authz module. The answer is "no, you cannot do this with mod_access". – crb Mar 10 '10 at 8:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.