I am looking at running an external service for clients to use here in my office while clients are working remotely at their office.
Assumptions: Both my office IP and clients office IP are static.
I wish to allow access to a service, for example an HTTP Basic Auth secured administration application, to my clients.
Is there a way in Apache Basic Auth or otherwise to create User @ IP based restrictions?
I would like:
- me @ my_office
- me @ my_home
- client1 @ their_office1
- client2 @ their_office2
For testing, I have attempted this code:
<Location />
Satisfy All
AuthType Basic
AuthName "Authorisation"
AuthUserFile /etc/apache2/passwd
Order deny,allow
Deny from all
Allow from 10.0.0.1/32
Require user me
Order deny,allow
Deny from all
Allow from 10.0.0.2/32
Require user client1
</Location>
- Testing with [me@10.0.0.1] allowed access, success.
- Testing with [client1@10.0.0.1] allowed access, fail.
- Testing with [client2@10.0.0.1] dis-allowed access, success (client2 is in htpasswd file, but not specified in Require User).
Is there a known way of doing this using Apache Basic Auth?
Also, instead of receiving a "Forbidden" for a successful user/password from an unknown IP, is it possible to ask Apache to request the user details again?