I am looking at running an external service for clients to use here in my office while clients are working remotely at their office.
Assumptions: Both my office IP and clients office IP are static.
I wish to allow access to a service, for example an HTTP Basic Auth secured administration application, to my clients.
Is there a way in Apache Basic Auth or otherwise to create User @ IP based restrictions?
I would like:
- me @ my_office
- me @ my_home
- client1 @ their_office1
- client2 @ their_office2
For testing, I have attempted this code:
<Location /> Satisfy All AuthType Basic AuthName "Authorisation" AuthUserFile /etc/apache2/passwd Order deny,allow Deny from all Allow from 10.0.0.1/32 Require user me Order deny,allow Deny from all Allow from 10.0.0.2/32 Require user client1 </Location>
- Testing with [email@example.com] allowed access, success.
- Testing with [firstname.lastname@example.org] allowed access, fail.
- Testing with [email@example.com] dis-allowed access, success (client2 is in htpasswd file, but not specified in Require User).
Is there a known way of doing this using Apache Basic Auth?
Also, instead of receiving a "Forbidden" for a successful user/password from an unknown IP, is it possible to ask Apache to request the user details again?