Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up an alias with permissions different than the root, like

www.restricted.com - one user

www.restricted.com/alias - another user

Is this possible?

I've set up the alias in httpd.conf at a separate directory (not subdirectory) with its own <directory> entry and separate auth setup. However, I get two password requests when trying to access /alias, for both sections. I am not sure whether it's because of a mistake on my part or by design.

Example:

<VirtualHost *:443>
        ServerName www.restricted.com
        DocumentRoot /var/www/site/main/

        <Directory /var/www/site/main/>

                AuthUserFile /var/www/site/.htpasswd
                AuthGroupFile /dev/null
                AuthName "main site"
                AuthType Basic
                Require user joe
        </Directory>

        Alias /alias /var/www/site/subsite/
        <Directory /var/www/site/subsite/>

                AuthUserFile /var/www/site/.htpasswd
                AuthGroupFile /dev/null
                AuthName "subsite"
                AuthType Basic
                Require user admin 
        </Directory>
</VirtualHost>

As the virtual host root and the alias are located in separate directories on the server, I think that <Directory> directives are more appropriate to use than <Location>.

share|improve this question

2 Answers 2

I prefer to use the <Location> directives to restrict access to different locations.

You can use the Require user-id directive to only allow access to particular users. See the example provided in that link. Here is another example, which is lifted from my own configuration.

In reality, the 'AuthUserFile' can be shared between both location, as the AuthUserFile only handles Authentication, not Authorization.

# This will allow access to / for 'user1'
<Location />
AuthName "Access allowed for user1"
AuthType Basic
AuthUserFile /etc/httpd/htpasswd.user1
Require user user1
</Location>

# This will allow access to /alias for 'user2'
Alias /alias/ /web/alias/
<Location /alias/>
AuthName "Access only allowed for user2"
AuthUserFile /etc/httpd/htpasswd.user2
Require user user2
</Location>
share|improve this answer

Using Directory directives applies the permissions on the physical directory structure; this is intended to prevent unintentional privilege grants.

The way to get this to work the way you want it to is to use the Location directive instead; this will apply the permissions settings only on the http virtual path that you specify with the directive.

share|improve this answer
    
I thought that <Directory> would be more correct as the /alias is located at a different location in the filesystem, so that entirely separate authentication rules would only apply if <directory> is used? (Whereas <Location> could possibly fail, because the alias would be contained within the "root" of the site wrt the URL?) Have I got it wrong? –  grojo Mar 16 '11 at 11:47
    
@grojo Instead of editing in a generic example, can you give us your actual config with the sensitive data changed? –  Shane Madden Mar 16 '11 at 14:17
    
I've changed the example ... unless I've missed something important, it should be identical in function :-) –  grojo Mar 21 '11 at 16:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.