Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Apache2 on Ubuntu and I have having some "weird" user authorization issues. I am using .htaccess to control access to my directories. I have many users and have grouped them into user groups which are defined in a "group" file. I then use .htaccess within each directory to define which users have access to the directory and which do not. Here is an example .htaccess file.

AuthUserFile /var/local/.htpasswd
AuthGroupFile /var/local/groups
AuthName "Username and Password Required"
AuthType Basic

require group design admin

Everything is working with one exception. I added a new user to one of my groups and though they can gain access to the directory they are prompted for a username and password for every resource (i.e. image, CSS). After a while I can just keep selecting "cancel" and I will get a page with just html with no images or CSS. I would think the browser would just cache the username/password. It seems to be working well for other users. Any thoughts?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

It almost sounds like

require group design admin

is requiring the user to be a member of both groups or the group file is not set up correctly.

design: usera userb userc admin: userd usere

No commas in the group file (this is different than the format for /etc/group)

LogLevel warn (possibly debug)

and watching your error log may give you a little more insight.

share|improve this answer
    
Thank you very much. Good suggestion. –  webworm Apr 13 '10 at 18:25

This sounds like a client issue. Can you reproduce the issue between multiple browsers and PCs?

share|improve this answer
    
I am only able to test with my computer but I can reproduce the issue from both Firefox and IE8. I have done some more testing and I can confirm that the user is being authenticated. If I try an access the protected area with a "junk" username and password I do not get access to any content at all. However if I use a username and password for a "real" user that has permissions to the directory then they are able to load the background but then are prompted again for the username and password. Also .. I find that if I move the user to the "admin" group they are able to gain access without issue –  webworm Mar 30 '10 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.