I'm having difficulty passing htdigest authentication through a reverse proxy setup on machine A, to machine B, which requires the authentication.

I'm setting up a home development network, with all the basic tools (Trac, hudson, git, svn, etc..) Having gotten most of these set up and running, I'm looking to allow access to them from the outside. Each service is running on it's own VM, for management purposes. I've setup a reverse proxy that is the target for all the port 80 requests, and based on the path, redirects them to the correct server.

The problem behaves as follows. The trac page /login requires credentials, then redirects to the home page. The first time you access it, it asks for the credentials. But when it redirects you to the home page, you are not logged in, and any attempt to access the login page again, just immediately redirects to the home page.

My apache config is below:

ProxyPass /trac http://server1/trac
ProxyPassReverse /trac http://server1/trac

<Proxy http://server1/trac>
    Order deny,allow
    Allow from all

#<ProxyMatch http://server1/trac/[^/]+/login>
#    LoadModule auth_digest_module /usr/lib/apache2/modules/mod_auth_digest.so
#    SetEnv proxy-chain-auth On
#    AuthType Digest
#    AuthName "trac"
#    AuthDigestDomain /trac
#    AuthUserFile /etc/apache2/trac.htdigest
#    Require valid-user

EDIT: Some further reading indicates that trac relies on cookies for this type of user authentication, so I'm guessing I need to proxy cookies somehow.

  • Are you using the commented ProxyMatch code you've posted? Try adding ProxyRequests On and ProxyVia On after ProxyPassReverse /trac http://server1/trac this may solve your problem. Also make sure you've enabled proxy_http_module. – tftd Jul 9 '11 at 3:41
  • The proxy match code is currently disabled. IT was from an attempt to move the authentication forward to the web facing server. This failed because I realized every edit was simply coming as an anonymous user. I did add the ProxyVia On with no luck. – mklauber Jul 9 '11 at 13:56

I've determined the problem was that I had not enabled the ProxyPassReverseCookieDomain directive:

ProxyPassReverseCookieDomain external_addr server1

Hope this helps someone in the future

  • I will do, as soon as allowed. – mklauber Jul 10 '11 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.