apache reverse proxy with basic auth

Question

I am trying to reverse proxy a web site with apache httpd 2.2 on centos 6. Access to part of that site should be restricted via basic auth. To that end, I have the following config:

<Location ~ "(/ac/sd|/myapp/pages)">
AuthType Basic
AuthName "Restricted area"
AuthBasicProvider file
AuthUserFile "/etc/httpd/passwords"
Require valid-user
</Location>

# restricted area
ProxyPass /ac/sd/pages/UI.php http://myapp-test.acme.org:8000/myapp/pages/UI.php
ProxyPassReverse /ac/sd/pages/UI.php http://myapp-test.acme.org:8000/myapp/pages/UI.php

ProxyPass /ac/sd/pages/logoff.php http://myapp-test.acme.org:8000/myapp/pages/logoff.php
ProxyPassReverse /ac/sd/pages/logoff.php http://myapp-test.acme.org:8000/myapp/pages/logoff.php

ProxyPass /ac/sd http://myapp-test.acme.org:8000/myapp
ProxyPassReverse /ac/sd http://myapp-test.acme.org:8000/myapp

ProxyPass /myapp/pages http://myapp-test.acme.org:8000/myapp/pages
ProxyPassReverse /myapp/pages http://myapp-test.acme.org:8000/myapp/pages
# unrestricted area
ProxyPass /ac/pages/UI.php http://myapp-test.acme.org:8000/myapp/portal/index.php
ProxyPassReverse /ac/pages/UI.php http://myapp-test.acme.org:8000/myapp/portal/index.php

ProxyPass /ac/pages/logoff.php http://myapp-test.acme.org:8000/myapp/portal/logoff.php
ProxyPassReverse /ac/pages/logoff.php http://myapp-test.acme.org:8000/myapp/portal/logoff.php

ProxyPass /ac/portal http://myapp-test.acme.org:8000/myapp/portal
ProxyPassReverse /ac/portal http://myapp-test.acme.org:8000/myapp/portal

ProxyPass /ac http://myapp-test.acme.org:8000/myapp
ProxyPassReverse /ac http://myapp-test.acme.org:8000/myapp

ProxyPass /portal http://myapp-test.acme.org:8000/myapp/portal
ProxyPassReverse /portal http://myapp-test.acme.org:8000/myapp/portal

The reverse proxy part is working, i have tested without the auth. Also the auth part is working, I have tested with a simple index.html that is not proxied but resides on the server that the above config is taken from.

Now what is not working is the authentication together with the reverse proxy. What happens is that when I try to access the site with a webbrowser, the popup asking for authentication appears, with "Restriced area" as part of the popup text. I enter the credentials, and after a short moment, without loading any content, the credential pop up appears again, this time with "myapp" in the pop up text. No matter what I enter in there, it keeps popping up again. So it seems that the first auth succeeded, but for some reason the proxied site sends another basic auth. That might be my missinterpretation - I do not really understand what is going on here.

I also tried to use an almost identical config to reverse proxy a python simpleHTTPServer. There the reverse proxy and authentication worked. So it seems there is something with my application together with proxying or authentication going on. Still, if there is no basic auth in the application, why does it keep popping up?

Any ideas?

Answer 1

After watching the traffic with tcpdump, I found that it is indeed the proxied server that is sending another authentication request.

The reverse proxy forwards the Authorization: Basic XXXXXXXXXXXXXXXXX header, and the application treats that as a valid login procedure. However, since the login credentials from the revers proxys htpassword file do not match with credentials stored in the application, the login fails and the application sends another authentication request.

What tripped me is that I expected that an basic auth request would come from the applications web server - which was wrong. Its in the application :)

Answer 2

Does it pop up more than twice? Redirects will cause the popup to show again.