Setting separate permissions for alias using <Directory> directive

Question

I am trying to set up an alias with permissions different than the root, like

www.restricted.com - one user

www.restricted.com/alias - another user

Is this possible?

I've set up the alias in httpd.conf at a separate directory (not subdirectory) with its own <directory> entry and separate auth setup. However, I get two password requests when trying to access /alias, for both sections. I am not sure whether it's because of a mistake on my part or by design.

Example:

<VirtualHost *:443>
        ServerName www.restricted.com
        DocumentRoot /var/www/site/main/

        <Directory /var/www/site/main/>

                AuthUserFile /var/www/site/.htpasswd
                AuthGroupFile /dev/null
                AuthName "main site"
                AuthType Basic
                Require user joe
        </Directory>

        Alias /alias /var/www/site/subsite/
        <Directory /var/www/site/subsite/>

                AuthUserFile /var/www/site/.htpasswd
                AuthGroupFile /dev/null
                AuthName "subsite"
                AuthType Basic
                Require user admin 
        </Directory>
</VirtualHost>

As the virtual host root and the alias are located in separate directories on the server, I think that <Directory> directives are more appropriate to use than <Location>.

Answer 1

I prefer to use the <Location> directives to restrict access to different locations.

You can use the Require user-id directive to only allow access to particular users. See the example provided in that link. Here is another example, which is lifted from my own configuration.

In reality, the 'AuthUserFile' can be shared between both location, as the AuthUserFile only handles Authentication, not Authorization.

# This will allow access to / for 'user1'
<Location />
AuthName "Access allowed for user1"
AuthType Basic
AuthUserFile /etc/httpd/htpasswd.user1
Require user user1
</Location>

# This will allow access to /alias for 'user2'
Alias /alias/ /web/alias/
<Location /alias/>
AuthName "Access only allowed for user2"
AuthUserFile /etc/httpd/htpasswd.user2
Require user user2
</Location>

Answer 2

Using Directory directives applies the permissions on the physical directory structure; this is intended to prevent unintentional privilege grants.

The way to get this to work the way you want it to is to use the Location directive instead; this will apply the permissions settings only on the http virtual path that you specify with the directive.