2
  • I am new to Apache Server Configuration.
  • I went through the Apache Documentation and tried to understand the Basics as well as the Directives.
  • But still, I am not able to figure out a configuration that I require for my current scenario.
  • The Version of my Apache Server is 2.4.6 running on Cent OS 7.5.

My Current "httpd.conf" file. (Contains Only the important bits)

ServerRoot "/etc/httpd"
Listen 80
ServerAdmin root@localhost
ServerName 127.0.0.1

<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>


<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<Location />
    AuthType shibboleth
    ShibRequireSession On
    Require valid-user
</Location>

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/var/www/html/mywebsitecontent/"
    ServerName myweb
</VirtualHost>

Problem:

  • According to the above configuration, typing "http://myweb/" in the browser URL will invoke Shibboleth Authentication as configured in <Location> directive.
  • But at the same time, if I host any other website in the "/var/www/html/" folder for example say "demo" website.
  • Now if try to access the demo website with http://127.0.0.1/demo/index.html, it will also invoke Shibboleth Authentication because of <Location /> configuration. And I don't want that.
  • I want the <Location> to only work for "/var/www/html/myweb/".

What I Tried:

  • <Location /myweb> - Not Working
  • Nesting <Location> in <VirtualHost> - Not Working

  • I don't know what I am doing wrong.
  • Any idea/suggestion/solution/right direction will be greatly appreciated.

2 Answers 2

1

According to https://httpd.apache.org/docs/2.4/mod/core.html#location

<Location> sections operate completely outside the filesystem. This
has several consequences. Most importantly, <Location> directives
should not be used to control access to filesystem locations. Since
several different URLs may map to the same filesystem location, such
access controls may by circumvented.

I think you want something closer to this:

<Directory "/var/www/html/myweb/">
    AuthType shibboleth
    ShibRequireSession On
    Require valid-user
</Directory>
<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/var/www/html/mywebsitecontent/"
    ServerName myweb
</VirtualHost>

edit: I think you want to add another specific VirtualHost for the demo site.

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/var/www/html/demo/"
    ServerName demo
</VirtualHost>
<VirtualHost *:80>
    <Directory "/var/www/html/myweb/">
        AuthType shibboleth
        ShibRequireSession On
        Require valid-user
    </Directory>
    ServerAdmin [email protected]
    DocumentRoot "/var/www/html/mywebsitecontent/"
    ServerName myweb
</VirtualHost>

Note that the default VirtualHost is the one at the top. So if you're accessing the site with http://127.0.0.1/ (note that ServerName will be 127.0.0.1, not demo, not myweb) you'll get the first one.

3
  • The behavior is same even if I use <Directory>. The Shibboleth Authentication is getting applied to the Server Level and hence to all the Applications hosted. Aug 7, 2018 at 14:53
  • I'd think that would be desired behavior, but if not, put the <Directory> stanza inside the <VirtualHost> stanza. Aug 7, 2018 at 16:54
  • Putting the <Directory> inside the <VirtualHost> exhibits the same behavior when it was outside. The Authentication is still working for all the Applications. This configuration is killing me. Aug 7, 2018 at 18:08
0

http://myweb/demo/ is a subfolder of http://myweb/ so your <Location /> covers that.

You need to put the <Location /> bit inside the VirtualHost block with ServerName myweb. Being outside any VirtualHost means it takes effect for all of your Apache server.

1
  • "demo" is not inside "myweb". It is outside "myweb". And I also tried nesting <Location> in <VirtualHost>, but still not working. Aug 7, 2018 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .