I am using Apache2 on Ubuntu and I have having some "weird" user authorization issues. I am using .htaccess to control access to my directories. I have many users and have grouped them into user groups which are defined in a "group" file. I then use .htaccess within each directory to define which users have access to the directory and which do not. Here is an example .htaccess file.

AuthUserFile /var/local/.htpasswd
AuthGroupFile /var/local/groups
AuthType Basic



Everything is working with one exception. I added a new user to one of my groups and though they can gain access to the directory they are prompted for a username and password for every resource (i.e. image, CSS). After a while I can just keep selecting "cancel" and I will get a page with just html with no images or CSS. I would think the browser would just cache the username/password. It seems to be working well for other users. Any thoughts?

-

It almost sounds like

is requiring the user to be a member of both groups or the group file is not set up correctly.

design: usera userb userc admin: userd usere

No commas in the group file (this is different than the format for /etc/group)

LogLevel warn (possibly debug)

and watching your error log may give you a little more insight.

-
Thank you very much. Good suggestion. –  webworm Apr 13 '10 at 18:25

This sounds like a client issue. Can you reproduce the issue between multiple browsers and PCs?

-
I am only able to test with my computer but I can reproduce the issue from both Firefox and IE8. I have done some more testing and I can confirm that the user is being authenticated. If I try an access the protected area with a "junk" username and password I do not get access to any content at all. However if I use a username and password for a "real" user that has permissions to the directory then they are able to load the background but then are prompted again for the username and password. Also .. I find that if I move the user to the "admin" group they are able to gain access without issue –  webworm Mar 30 '10 at 15:44