Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I setup Joomla to require or bypass authentication based on visitors IP address?

I would like to setup a Joomla website that requires visitors to login, unless they are visiting from a specific IP address or subnet.

Also, I would like the login to be LDAP based.

I would be hosting the Joomla site on my local network and exposing it via my router with port-forwarding.

share|improve this question
Does the solution need to log your users in to Joomla, or is it good enough if it allows or denies them access to Joomla? What webserver are you using? – sciurus Sep 1 '11 at 18:31
Do you expect the web server to do authentication via HTTP, or did you want your application to do authentication via forms? If you go pure HTTP auth, then this should be pretty easy. – Zoredache Sep 2 '11 at 20:00
It does not need to log them into Joomla, just allow or deny access. I am currently using Apache. Can HTTP auth be done via HTTPS? – Corey Sep 7 '11 at 13:46
up vote 2 down vote accepted

I would like to setup a Joomla website that requires visitors to login, unless they are visiting from a specific IP address or subnet.

Create a Virtual Host for Joomla as belows:

<VirtualHost *:80>
    ServerAdmin ...
    DocumentRoot /var/www/html/joomla
    ErrorLog logs/joomla.error_log

    <Directory "/var/www/html/joomla">
        Options ...
        Order allow,deny
        Allow from
        Satisfy Any

Also, I would like the login to be LDAP based.

You can do it by using mod_authz_ldap, something like this:

LoadModule authz_ldap_module modules/

<IfModule mod_authz_ldap.c>

   <Location /var/www/html/joomla>
       AuthBasicProvider ldap
       AuthzLDAPAuthoritative Off
       AuthLDAPURL ldap://IP:3268/dc=domain,dc=com?sAMAccountName
       AuthLDAPBindDN cn=binduser,dc=domain,dc=com
       AuthLDAPBindPassword secret
       AuthType Basic
       AuthName "Authorization required"
       require valid-user
       AuthzLDAPLogLevel debug


Is HTTPS auth using LDAP (MS-AD) an option?


share|improve this answer
Is it possible to have the login prompt done securely (over HTTPS) but host the site itself over normal HTTP? – Corey Sep 8 '11 at 13:17
As my understand, it is impossible. Either you force a redirect to https or you should do it at PHP code: login via https and redirect back to http after that. – quanta Sep 8 '11 at 15:15

Im not sure if this is what you are after but..

Another option is to change the .htaccess file to allow access by IP

<Limit GET>
    Order Deny,Allow
    Deny from all
    Allow from

Optional: You can add multiple addresses by separating them with comma's., 
share|improve this answer

The Apache documentation to look at is Access Control (the 'by host' section), Authentication, Authorization and Access Control (the 'satisfy' directive), mod_auth_basic, and mod_authnz_ldap. A sample configuration to do what you want is

AuthType Basic
AuthBasicProvider ldap
AuthName "Joomla"
# change the ldap attributes to what matches your environment
AuthLDAPBindDN "uid=example,ou=example,dc=example,dc=com"
AuthLDAPBindPassword example
AuthLDAPURL "ldap://"
Order allow,deny
# change the ip to match your network that should not have to authenticate
Allow from
Satisfy any
share|improve this answer

You might want to consider using .htaccess to simply put a username/password there, so unless they have the front-end password they can't get to the website at all.

share|improve this answer

You should set up nginx as a proxying frontend. Nginx can do this using the following config directives:

auth_basic      "Restricted";
auth_basic_user_file  htpasswd;
satisfy any;
deny all;

This way you can bypass the authentication for IPs listed explicitly in allow and have the auth popup dialog for all other IPs.

share|improve this answer
Is HTTPS auth using LDAP (MS-AD) an option? – Corey Sep 7 '11 at 13:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.