I tried to find a solution, but my case is the opposite of most configurations and it's getting hard to find examples.
I have a php application who looks for the typical HTTP Authentication first, and in case it fails (No REMOTE_USER var found), it shows a login screen to authenticate against a local user file. I cannot modify this php app.
I need to configure apache's authentication to match this scenerario: If the remote IP matches our network ip range (let's say 192.168.0), require an AuthType Basic to access the page. If the remote IP it's not in our range (the rest of the internet), skip the AuthType Basic and show the page directly, so the php app will not found the REMOTE_USER variable and it will show his own login page.
Is that possible? I found plenty of examples doing exactly the opposite (asking for Apache Auth if you're not on the company network) but I don't see any matching my case.
I was modifying this example:
<Directory /home/www/site1/private> AuthUserFile /home/www/site1-passwd AuthType Basic AuthName MySite Require valid-user Order allow,deny Allow from 192.168.0 Satisfy any </Directory>
It would be great to specify "Allow from !(172.17.10)", but I don't think this is possible. So I'm pretty sure I need to play around with the Allow, Deny, and Order directives, but I still didn't find a solution.
Anyone who faced a similar situation? Thanks!