Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using something like this in .htaccess file to restrict access to the website:

AuthUserFile /some/directory/.passwd
AuthGroupFile /dev/null
AuthName EnterPassword
AuthType Basic
require valid-user

This works fine but the user is asked to authenticate each time a subdomain is changed, like user1.mywebsite.com, user2.mywebsite.com or just mywebsite.com

Is there a way to tell Apache2 that when a user is authenticated against one subdomain, it should grant him access to all others as well?

share|improve this question
    
With HTTP authentication it really depends on the browser, since the browser is what decides when reauthentication is necessary (based on information provided by the server, of course). But I would imagine that the behavior is fairly standard across the major browsers... I just don't know what it is. –  David Z Sep 6 '09 at 22:40
add comment

migrated from stackoverflow.com Sep 6 '09 at 19:30

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 1 down vote accepted

Not possible; you can use a single .htaccess file to grant access to anything in your directory tree with the same credentials, but authentication is required for each unique subdomain.

As Benny points out, you'll need session-based authentication in some form to accomplish this.

share|improve this answer
add comment

It is impossible to do such thing by http basic auth specs. Realms bob.example.com and elisa.example.com are two different protection spaces and almost every browser will treat them as 2 seperate,different realms to whom different authentification credentials should be suplied.

How ever, there is solution - HTTP digest auth . It allows you to specify all domains that are URLs in protection space. However, it does not allow wildcard subdomains, so after dozen of domains it gets quite a PITA. Example config .

<Location />
  AuthType Digest
  AuthName "teh realm"
  AuthDigestAlgorithm MD5
  AuthDigestDomain / http://domain.com/ http://subdomain.domain.com/ 
  AuthDigestQop auth
  AuthDigestProvider file
  AuthUserFile /etc/apache2/.htpasswd-digest
</Location>

IMO, that your only choice is to write own FastCGI authenticator who users cookies, who allow wildcard subdomains . If you have few domains, its easier to stick with digest.

share|improve this answer
1  
Thanks for this trick. Won't do it for me though, as I have an undefined number of subdomains. I have written authentication middleware on application level instead. Works equially well. –  michuk Sep 7 '09 at 22:55
add comment

Are all of the subdomains being served from subfolders of the same docroot? If they are, it would seem like putting that authentication in .htaccess of the primary docroot might mitigate the repeated authentication.

As an alternative (though it may take some development work for your user), you might try session based authentication instead.

http://httpd.apache.org/docs/2.3/mod/mod%5Fsession.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.