Securing access to virtual directories with valid users determined by part of the URL

Question

I'm not a very experienced Apache sysadmin (fell in to the role as I was the only person who knew anything at all about it!) and I'm really stuck with this problem. Thanks to an over-zealous salesman I have to come up with a solution fast...

Basically, we have an Apache server that, among other things, is used to proxy incoming connections to some proprietary software on virtual machines. Each customer has their own VM and a distinct URL. The URLs are obfuscated and a RewriteMap script is used to determine where to proxy to based on information in an LDAP directory (and some other factors):

RewriteMap   routing_map  prg:/scripts/routing_map.pl
RewriteRule  ^/app/([^/]+)(.*)$  ${routing_map:$1:$2}  [P,QSA,L]

This all works fine.

Now the problem:

We have to map another path and proxy to the virtual machines in a similar way, but this time it needs to be password protected. All the users are in the LDAP directory under separate organizational units on a per customer basis. Only users from customerA should be able to access customerA's virtual machine.

Is there a way to do something similar to the RewriteMap but with security? i.e. based on the unique customer part of the URL tell Apache to use different filters when searching LDAP to authenticate users? In the example Apache configuration below I need XXXX to be substituted with the unique customer part of the URL being accessed.

AuthType Basic
AuthBasicProvider ldap
AuthName "Restricted Access"
AuthzLDAPAuthoritative on
AuthLDAPURL ldap://ldap.local/dc=batch?sub
Require ldap-group cn=customers,ou=group,dc=batch
Require ldap-attribute x-od-customer=XXXX
Satisfy All

After lots of Googling and experimentation I'm completely stuck and need some advice please

Cheers!

Answer 1

For security you wouldn't want to do this, as anything accessible to the user in a URL is also accessible to an attacker in the URL. This will be why you have not found useful information on how to do it.

What you want is to keep all session management serverside. Once you have authenticated the user you use secured session tokens to track them, then if they want to go to a particular area you assess whether they can through their profile held serverside.

For some useful guidance check out this question on Security Stack Exchange or look at the questions under the session tag.