In our development environment we're using the following VHost-Configuration for the majority of our projects:
<VirtualHost *> ServerName misc.webdev.local ServerAlias *.webdev.local UseCanonicalName Off VirtualDocumentRoot /var/www/webdev.local/%0/htdocs <Directory "/var/www/webdev.local/*/htdocs"> # Some configuration </Directory> </VirtualHost>
With this dynamic vhost configuration we don't need to add a vhost config for each project.
My goal is to set a semi automatic basic access authentication for these dynamic vhost. For example:
- Project A has no specific useraccounts so take the default account (eg. User / Password)
- Project B has a specific useraccount to take this specific account to be required for login
This should happen without the need to change the apache configuration
1) My first attempt was to compile mod_authnz_external as an apache module to pass the authentication data to an external script which could check the provided useraccount data against a postgresql database. This setup worked but is really slow because the external script is instantiated for every http-request.
I know that there are several apache modules out there to pass the authentication data to the database directly but with this solution I can't specify default accounts or fallbacks for specific projects
2) My second attempt is more a compromise than the ideal solution. But, apart from that, I don't know how to accomplish this (in pseudo code):
... <Directory "/var/www/webdev.local/*/htdocs"> Deny from all AuthType Basic <IfFileExists "/var/www/accounts/%0.htpasswd"> AuthUserFile /var/www/accounts/%0.htpasswd <Else> AuthUserFile /var/www/accounts/default.htpasswd </IfFileExists> AuthName "please log in" require valid-user Satisfy any </Directory> ...
But because there is no IfFileExists directive on the one hand and no possibility to use the dynamic VHost wildcard in this context on the other hand I don't know if and how this is possible?
3) I think the ideal solution is if apache would passes the given authentication data from the user to a small socket daemon and builds a small cache where is stores the return value for several minutes.
The author of mod_authnz_external already thought about it but there is now implementation at this moment.
So I wonder if anyone of you has some input for me?
Thanks folks and best regards