Apache authentication requirement based on location

Question

I am trying to configure my apache server to have the following rule. If the request comes from 192.168.., no authentication is required. But from anywhere else, I want to require them to log in.

So far I have the second part configured:

Alias /Downloads "D:/Downloads"
<Directory "D:/Downloads">
    Options All Indexes
    AllowOverride AuthConfig
    Allow from all
    AuthType Basic
    AuthName "Restricted Files"
    AuthUserFile D:/Webserver/apache_auth_files/.htpasswd-users
    Require user myuser_name
</Directory>

But How do I create a exception in the rule to allow 192.168.. to not require authentication?

Answer 1

What you're looking for is Satisfy Any - it allows access if someone meets the IP ACL or the Require directive, they don't have to fulfill both, so a user outside the IP range must authenticate, but a user inside of it does not.

Try this:

Alias /Downloads "D:/Downloads"
<Directory "D:/Downloads">
    Options All Indexes
    AllowOverride AuthConfig
    Satisfy Any
    Order deny,allow
    Deny from all
    Allow from 192.168.0.0/16
    AuthType Basic
    AuthName "Restricted Files"
    AuthUserFile D:/Webserver/apache_auth_files/.htpasswd-users
    Require user myuser_name
</Directory>