Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a <Location> within a virtualhost that looks like this:

  <Location /app1/>
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLRequireSSL
    SSLOptions +OptRenegotiate
    SSLCipherSuite HIGH
    SSLRequire %{SSL_CLIENT_S_DN_OU} eq "Customer1" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer2" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer3"
 </Location>

This requires everyone who wants to access /app1/ to present a client certificate to the server. Backend server is tomcat.

Is it possible to "route" visitors who don't authenticate to a different location than visitors who have a certificate? E.g. the ones with no certificate get less functionality...

Thank you

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You can use mod_rewrite to send people somewhere else.

At first, you must configure your Apache so that it allows people without a certificate in (i.e. use SSLVerifyClient optional) Note that this may break with certain browsers. Check this before going live.

Then, as a second step, you can use mod_rewrite like so:

RewriteEngine On
# Only match requests which don't have a proper client certificate
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !SUCCESS

# Prefix the URL for those people with /guest
RewriteRule ^/(.*)$ /guest/$1
share|improve this answer
    
Thx for the hint, I will try that. –  zero_r Jul 13 '11 at 8:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.