I'm working with Redmine, a Rails application that is being served by Apache + Passenger. The entire site is authenticated using Shibboleth. However Redmine has an API that needs to be available to users and available without using shibboleth! Seems easy enough.
To get around shib I have the following inside of my site config within
<FilesMatch ".(json|xml)$"> Order allow,deny Allow from 192.168.1. </FilesMatch>
This works perfectly when accessing: https://example.com/issues.json, I'm not prompted to authenticate via shib and returns the expected data as long as I pass in my API Key.
However when trying to access: https://example.com/issues/23.json it fails and I get bounced back to the shibboleth login page. From what I understand the FilesMatch directive should be seeing I'm requesting a .json file and let me get it, but that isn't happening.
Any pointers would be appreciated.