Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to allow public access to a method that generates a WSDL-file for our API. The rest of the site is behind basic auth protection. Can you guys take a look at the following virtual-host configuration and see why the override does not take place?

<VirtualHost *:80>
        ServerName xyz.mydomain.com
        DocumentRoot /var/www/dev/public

        <Directory /var/www/dev/public>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all

                SetEnv APPLICATION_ENV testing
        </Directory>

        <Location />
                AuthName "XYZ Development Server"
                AuthType Basic
                AuthUserFile /etc/apache2/xyz.passwd
                Require valid-user
        </Location> 

        <Location /api/soap/wsdl>
           Satisfy Any
           allow from all
        </Location>

</VirtualHost>
share|improve this question

2 Answers 2

I believe you need:

Satisfy any
allow from all

in a Directory Block rather than a Location Block for it to be considered.

share|improve this answer
    
Hmm... but I don't want to protect files, but rather a location (or all locations except a specific one). The problem is that I use a FrontController pattern, so /api/soap/wsdl is rewritten to index.php and Zend Framework routes it from there... How would you propose that I create a .htaccess-file that would allow this? –  PatrikAkerstrand Jun 17 '10 at 15:37
    
That would be the problem then. Since index.php is within your authentication realm. What you might be able to do is put a symlink to index.php in an unprotected directory and do something like Alias /unprotected.php /path/to/symlinked/index.php and change your rewrite for the wdsl to use unprotected.php Your rewrite changes your authentication realm which is why your satisfy any/allow from all isn't working. It does actually work (I tested it here), but, when you do the rewrite, your other rules take over. –  user6738237482 Jun 17 '10 at 15:57

The Location (and LocationMatch) directive can use Regular Expression. Why not use a Location match with a regex to not match the API page you are hosting. For example:

<LocationMatch "(?!/api/soap/wsdl)">
  AuthName "XYZ Development Server"
  AuthType Basic
  AuthUserFile /etc/apache2/xyz.passwd
  Require valid-user
</LocationMatch>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.