Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VirtualHost in Apache which uses ServerAlias with a wildcard to match a lot of subdomains, like this:

<VirtualHost>
    ServerName foo.com
    ServerAlias *.foo.com
</VirtualHost>

There are hundreds of subdomains which matches the alias, and now I want an authentication prompt for a specific subdomain: bar.foo.com

How would one go about doing such a thing?

I have thought of creating a new VirtualHost for bar.foo.com, but I would preferably like to avoid this, as it becomes a hassle once I want to add more domains like this.

share|improve this question
add comment

2 Answers 2

Depends how you have your directory structure (what's your VirtualDocumentRoot look like?), but this is probably a good situation for an .htaccess file in the site's directory looking something like this:

AuthType Basic
AuthName "bar.foo.com"
AuthUserFile /var/www/bar.foo.com/.htpasswd
Require valid-user

Set up the .htpasswd file:

htpasswd -c /var/www/bar.foo.com/.htpasswd username1
htpasswd /var/www/bar.foo.com/.htpasswd username2
...

If possible, encrypt this traffic, too. Basic auth is sent through HTTP in cleartext, so it's a good idea to encrypt it with SSL.

share|improve this answer
    
Thanks for your reply! The DocumentRoot (i.e. /srv/www/htdocs/foo.com) is shared between all the subdomains. I am already familiar with how to configure the basic authentication, and I have tried the solution you propose. Unfortunately, it also requests authentication credentials when you try to access bar2.foo.com, and not just bar.foo.com (which is what I want). Perhaps I didn't clarify this properly in my question. –  paaleivind Mar 25 '11 at 15:02
    
@paaleivind Since you have a shared DocumentRoot, instead of using VirtualDocumentRoot (what's the point of having authentication on only one domain, when they all host the same files?), this won't work without reorganizing the directory structure; the only valid contexts for Require are .htaccess and <Directory>, both of which won't work with how you have things set up. More detail on what you're trying to accomplish with this setup would help. –  Shane Madden Mar 25 '11 at 15:10
    
The sites bar.foo.com and bar2.foo.com provide different content for the end-user, and are thus actually different sites, even though they share the same DocumentRoot and code. The client whose site is running on bar.foo.com has now requested that we add basic authentication for their site, however we obviously do not want that for all of our other sites/clients. I've had suspicions that this might not be possible at all given the current directory structure, but I was hoping for a possible workaround, as these are the cards I've been dealt. –  paaleivind Mar 25 '11 at 15:27
    
@paaleivind Ah, ok. Well, if it's possible, having the application do the authentication would probably be the best way to go. If that's not feasible, then setting up a separate VirtualHost is unfortunately probably your best option. –  Shane Madden Mar 25 '11 at 15:33
add comment

I had the same Problem and solved it just by now.

Let's assume, you have two VirtualHosts "open.example.com" and "resticted.example.com" with shared Document Root "/path/to/your/web-root". You wan't people to be able to access open.example.com without password but requiring a password for restriced.example.com. Then your configuration would be the following:

<Directory /path/to/your/web-root>

    Order Deny,Allow
    Deny From All

    SetEnvIf Host open.example.com allowed
    Allow from env=allowed 

    AuthType Basic
    AuthName "Won't let you in, if you don't tell me your name and password"
    AuthUserFile /etc/apache2/htusers

    Require valid-user

    Satisfy Any
</Directory>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.