Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to deny access if the REMOTE_USER does not match The site is protected by Require valid-user (as usual). Currently anybody can access all areas so long as she's logged in.

The intended behavior is this:

  • alice can access and nothing else
  • bob can access and nothing else
  • bonus points for granting all-access to admin

Sound too easy? Here's the catch: Subdomains/usernames are dynamic, so any hard-coded "alice" or "bob" strings do not count!

Is there any way I can do that with Apache?


share|improve this question
up vote 0 down vote accepted

As the apps I'm trying to authorize are all Rack apps, I've ended up implementing this as a Rack middleware, released as the Portarius gem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.