Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having difficulty passing htdigest authentication through a reverse proxy setup on machine A, to machine B, which requires the authentication.

I'm setting up a home development network, with all the basic tools (Trac, hudson, git, svn, etc..) Having gotten most of these set up and running, I'm looking to allow access to them from the outside. Each service is running on it's own VM, for management purposes. I've setup a reverse proxy that is the target for all the port 80 requests, and based on the path, redirects them to the correct server.

The problem behaves as follows. The trac page /login requires credentials, then redirects to the home page. The first time you access it, it asks for the credentials. But when it redirects you to the home page, you are not logged in, and any attempt to access the login page again, just immediately redirects to the home page.

My apache config is below:

ProxyPass /trac http://server1/trac
ProxyPassReverse /trac http://server1/trac

<Proxy http://server1/trac>
    Order deny,allow
    Allow from all
</Proxy>

#<ProxyMatch http://server1/trac/[^/]+/login>
#    LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so
#    SetEnv proxy-chain-auth On
#    AuthType Digest
#    AuthName "trac"
#    AuthDigestDomain /trac
#    AuthUserFile /etc/apache2/trac.htdigest
#    Require valid-user
#</ProxyMatch>

EDIT: Some further reading indicates that trac relies on cookies for this type of user authentication, so I'm guessing I need to proxy cookies somehow.

share|improve this question
    
Are you using the commented ProxyMatch code you've posted? Try adding ProxyRequests On and ProxyVia On after ProxyPassReverse /trac http://server1/trac this may solve your problem. Also make sure you've enabled proxy_http_module. –  tftd Jul 9 '11 at 3:41
    
The proxy match code is currently disabled. IT was from an attempt to move the authentication forward to the web facing server. This failed because I realized every edit was simply coming as an anonymous user. I did add the ProxyVia On with no luck. –  mklauber Jul 9 '11 at 13:56
add comment

1 Answer

up vote 2 down vote accepted

I've determined the problem was that I had not enabled the ProxyPassReverseCookieDomain directive:

ProxyPassReverseCookieDomain external_addr server1

Hope this helps someone in the future

share|improve this answer
1  
You should accept your own answer. –  bahamat Jul 9 '11 at 16:18
    
I will do, as soon as allowed. –  mklauber Jul 10 '11 at 2:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.