Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not a very experienced Apache sysadmin (fell in to the role as I was the only person who knew anything at all about it!) and I'm really stuck with this problem. Thanks to an over-zealous salesman I have to come up with a solution fast...

Basically, we have an Apache server that, among other things, is used to proxy incoming connections to some proprietary software on virtual machines. Each customer has their own VM and a distinct URL. The URLs are obfuscated and a RewriteMap script is used to determine where to proxy to based on information in an LDAP directory (and some other factors):

RewriteMap   routing_map  prg:/scripts/
RewriteRule  ^/app/([^/]+)(.*)$  ${routing_map:$1:$2}  [P,QSA,L]

This all works fine.

Now the problem:

We have to map another path and proxy to the virtual machines in a similar way, but this time it needs to be password protected. All the users are in the LDAP directory under separate organizational units on a per customer basis. Only users from customerA should be able to access customerA's virtual machine.

Is there a way to do something similar to the RewriteMap but with security? i.e. based on the unique customer part of the URL tell Apache to use different filters when searching LDAP to authenticate users? In the example Apache configuration below I need XXXX to be substituted with the unique customer part of the URL being accessed.

AuthType Basic
AuthBasicProvider ldap
AuthName "Restricted Access"
AuthzLDAPAuthoritative on
AuthLDAPURL ldap://ldap.local/dc=batch?sub
Require ldap-group cn=customers,ou=group,dc=batch
Require ldap-attribute x-od-customer=XXXX
Satisfy All

After lots of Googling and experimentation I'm completely stuck and need some advice please


share|improve this question

For security you wouldn't want to do this, as anything accessible to the user in a URL is also accessible to an attacker in the URL. This will be why you have not found useful information on how to do it.

What you want is to keep all session management serverside. Once you have authenticated the user you use secured session tokens to track them, then if they want to go to a particular area you assess whether they can through their profile held serverside.

For some useful guidance check out this question on Security Stack Exchange or look at the questions under the tag.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.