Authentication works for filesystem but not reverse proxy

Question

I have a Mac Mini with OS X Server 5.1.7 running. I have a service running locally accessible via http://127.0.0.1:3000/ask (without authentication) and I want to make it available to the outside but with authentication using OS X Server directory.

So, in the websites section I created a new website named intranet.mydomain.com which is accessible only to "Intranet Users" (a group I created).

After doing this, I try to access https://intranet.mydomain.com , it asks for username and password and it works with the credentials of a user that is part of "Intranet Users".

Now, to setup the reverse proxy, I go to to the file

/Library/Server/Web/Config/apache2/sites/0000_127.0.0.1_34543_intranet.mydomain.com.conf

And add the following:

ProxyPass /ask http://127.0.0.1:3000/ask

ProxyPassReverse /ask http://127.0.0.1:3000/ask

after the Directory node.

Now, when accessing https://intranet.mydomain.com/ask , I get to the internal service but no authentication is requested. Which should be fine, I believe, since in the XML config only the Directory node has the authentication configured:

<Directory "/Library/Server/Web/Data/Sites/intranet.mydomain.com">
    Options All -Indexes -ExecCGI -Includes +MultiViews
    AllowOverride None
    <IfModule mod_dav.c>
        DAV Off
    </IfModule>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
    AuthType Digest
    AuthName "Realm ID 75040558"
    <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
      Require no-user
    </Limit>
    <Limit GET HEAD OPTIONS CONNECT POST>
      Require group memberusers
    </Limit>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
</Directory>

So, to make it global (for both filesystem and paths not in filesystem), I changed the Directory node to a location node, like this:

<Location "/">
    Options All -Indexes -ExecCGI -Includes +MultiViews
    AllowOverride None
    <IfModule mod_dav.c>
        DAV Off
    </IfModule>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
    AuthType Digest
    AuthName "Realm ID 75040558"
    <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
      Require no-user
    </Limit>
    <Limit GET HEAD OPTIONS CONNECT POST>
      Require group memberusers
    </Limit>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
</Location>

After doing this, accessing the route of my domain, I'm asked for authentication and I can login. However, accessing the path https://intranet.mydomain.com/ask I'm asked for authentication (all good!) but it does not accept any username/password of valid user (note that it works for the / but not for /ask).

Any idea why?

Here's my complete config file for this website before changing the Directory to Location:

<VirtualHost 127.0.0.1:34543>
    ServerName https://intranet.mydomain.com:443
    ServerAdmin [email protected]
    DocumentRoot "/Library/Server/Web/Data/Sites/intranet.mydomain.com"
    DirectoryIndex index.html index.php default.html
    CustomLog /var/log/apache2/access_log combinedvhost
    ErrorLog /var/log/apache2/error_log
    <IfModule mod_ssl.c>
        SSLEngine Off
        SSLCipherSuite "HIGH:MEDIUM:!MD5:!RC4"
        SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
        SSLProxyEngine On
        SSLCertificateFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.cert.pem"
        SSLCertificateKeyFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.key.pem"
        SSLCertificateChainFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.chain.pem"
        SSLProxyProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
    </IfModule>
    <Directory "/Library/Server/Web/Data/Sites/intranet.mydomain.com">
        Options All -Indexes -ExecCGI -Includes +MultiViews
        AllowOverride None
        <IfModule mod_dav.c>
            DAV Off
        </IfModule>
        <IfDefine !WEBSERVICE_ON>
            Require all denied
            ErrorDocument 403 /customerror/websitesoff403.html
        </IfDefine>
        AuthType Digest
        AuthName "Realm ID 75040558"
        <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
          Require no-user
        </Limit>
        <Limit GET HEAD OPTIONS CONNECT POST>
          Require group memberusers
        </Limit>
        <IfDefine !WEBSERVICE_ON>
            Require all denied
            ErrorDocument 403 /customerror/websitesoff403.html
        </IfDefine>
    </Directory>
    ProxyPass /ask http://127.0.0.1:3000/ask
    ProxyPassReverse /ask http://127.0.0.1:3000/ask
</VirtualHost>