2

I have a <Location> within a virtualhost that looks like this:

  <Location /app1/>
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLRequireSSL
    SSLOptions +OptRenegotiate
    SSLCipherSuite HIGH
    SSLRequire %{SSL_CLIENT_S_DN_OU} eq "Customer1" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer2" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer3"
 </Location>

This requires everyone who wants to access /app1/ to present a client certificate to the server. Backend server is tomcat.

Is it possible to "route" visitors who don't authenticate to a different location than visitors who have a certificate? E.g. the ones with no certificate get less functionality...

Thank you

1 Answer 1

3

You can use mod_rewrite to send people somewhere else.

At first, you must configure your Apache so that it allows people without a certificate in (i.e. use SSLVerifyClient optional) Note that this may break with certain browsers. Check this before going live.

Then, as a second step, you can use mod_rewrite like so:

RewriteEngine On
# Only match requests which don't have a proper client certificate
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !SUCCESS

# Prefix the URL for those people with /guest
RewriteRule ^/(.*)$ /guest/$1
1
  • Thx for the hint, I will try that.
    – zero_r
    Jul 13, 2011 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .