I'm having trouble figuring out how to adding basic HTTP authentication to password-protect a development testing environment running on a production web server. Both the main site and the testing environment are virtual hosts that use AJP proxying to serve separate instances of Tomcat webapps. We need to prevent the public from accessing the testing environment without making changes to web.xml in the Tomcat environment the protection must be achieved with Apache not Tomcat. However the ProxyPass and ProxyPassReverse directives in the virtual host seem to override the use of .htaccess or anything I put in a <Directory> control block, while it seems that I cannot use directives like AuthType in the main body of the <VirtualHost> control block alongside. I'm not very experienced with Apache (or Tomcat) and unsure about what directives can apply where and which might override others. Because the changes need to be made on a production server, I can't easily experiment for fear of causing any downtime.

The httpd.conf itself is very simple:

LoadModule  proxy_http_module   /usr/lib/apache2/modules/mod_proxy_http.so
LoadModule  headers_module      /usr/lib/apache2/modules/mod_headers.so

LoadFile    /usr/lib/libxml2.so

The relevant virtual host file, /etc/apache2/sites-available/dev443 is as follows:

<IfModule mod_ssl.c>
<VirtualHost dev.mydomain.com:80443>
    ServerName  dev.mydomain.com:80443
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/dev

    ProxyPass / ajp://
    ProxyPassReverse / ajp://

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    <Directory /var/www/dev/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All 
        Order allow,deny
        allow from all

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all

    ErrorLog /var/log/apache2/error.log

    LogLevel info

    CustomLog /var/log/apache2/ssl_access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from ::1/128

    SSLEngine on

    SSLCertificateFile    /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
    SSLCACertificateFile  /etc/ssl/certs/intermediate.crt

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars

    BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown


For the record, the following versions are involved: Apache: 2.2.14 / Tomcat: 7.0.23 / Java: SE 1.6.0_26-b03 / OS: Ubuntu 10.04 LTS

  • I think it will be more secure to restrict the access using allow from and deny from instead of authentication to block access from public. – Khaled Jan 23 '12 at 9:14
  • Currently, we're filtering by IP using the firewall, which is essentially the same approach. However, a few people involved in the project need access to the testing environment from home and they don't have fixed IP addresses for their Internet connections, so I though password protection would involve less maintenance in the long run. – Joe Carroll Jan 23 '12 at 11:32
  • Can I move the AJP proxy configuration within a <Proxy> control block? I had a look at this StackOverflow Q&A that suggests it supports authentication. Would it be supported inside a <VirtualHost> control block (the solution has it in httpd.conf)? – Joe Carroll Jan 23 '12 at 11:39

As you've discovered, the <Directory> blocks don't apply because you're serving content from a proxy server, not a local directory.

Try <Location> instead.

<Location />
    ProxyPass ajp://
    ProxyPassReverse ajp://
    AuthType Basic
    AuthName "something"
    AuthUserFile /path/to/htpasswd
    Require valid-user
  • I had just started looking into the possibility of using <Location> but I was having trouble finding confirmation in the documentation that this approach was supported and hadn't gotten around to testing it. The documentation specifies that the contexts in which these directives are allowed includes <Directory> but there's no mention there of <Location> although it seems that <Location> and <Directory> are effectively equivalent/interchangeable (except for the distinction of the source of the content). – Joe Carroll Jan 24 '12 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.