Apache2: nested require statements within Location

Question

I'd like to set up different LDAP authorization rules for different levels of an URL. This is the config currently used

    <Location />
            AuthType Basic
            AuthName "Foo"
            AuthBasicProvider ldap
            AuthLDAPURL "..."
            AuthLDAPBindDN  "..."
            AuthLDAPBindPassword "..."
    </Location>

    <Location />
            Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
    </Location>

    <Location /path/>
            Require ldap-user bar
    </Location>

The problem is that /path/ inherits the rules from /. Hence for user bar to be able to access /path/ he must also be in the foo group.

How can I configure the user bar to be able to access /path/ without also having to be a member of group foo?

---

EDIT: Changed ldap-group to ldap-user for /path/ for an accurate problem description.

Answer 1

My understanding (and I just struggled to find solid supporting documentation) is that Location directives are cumulative, so you're essentially applying two Require directives. What if you did something like this:

<LocationMatch "/[^path]">
    Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
</Location>

<Location /path/>
    Require ldap-group cn=bar,ou=Groups,dc=com,dc=company
</Location>

You'll have to check if that regular expression is apache-compatible, but I believe this approach will work.