We have some rules for a subtree of Locations, which involve Require-ing ldap-group and expr-s.

The user is duly challenged to supply login-credentials, which are verified.

However, even when the credentials are correct and the access is denied due to other reasons (such as belonging to a wrong group or coming from an incorrect IP-address), the server's response is always 401 -- instead of 403.

As a result, the browsers keep prompting users to "try again"... Can I tell Apache (2.4) to use 403, if the information supplied in the Authorization-header checks-out, and it is some other rule, that rejects the request?

Again, I know, why, after the authentication succeeds, the authorization is denied for some of the users -- it is supposed to. I just need to communicate to such users, that: "Yes, we believe you are who you say you are, but you aren't allowed to access this location."

It appears, mod_rewrite is the only method to induce a 403-response -- can a mod_rewrite expression check membership of an LDAP-group or forcibly change the status from 401 to 403?

I asked this question on the WebMaster's site, but got no answers -- folks there seem more content-oriented.

Here is my the relevant snippet of my current config:

<Location /foo>
         Require ldap-group CN=foo,OU=Groups,DC=example,DC=net

When the supplied username/password are verified, but the requirement is not satisfied, I need to return a 403... 401 is being returned currently.


I think what you want is AuthzSendForbiddenOnFailure:

AuthzSendForbiddenOnFailure On

Context: directory, .htaccess

If authentication succeeds but authorization fails, Apache HTTPD will respond with an HTTP response code of '401 UNAUTHORIZED' by default. This usually causes browsers to display the password dialogue to the user again, which is not wanted in all situations. AuthzSendForbiddenOnFailure allows to change the response code to '403 FORBIDDEN'.

Note that it carries a security warning:

Security Warning

Modifying the response in case of missing authorization weakens the security of the password, because it reveals to a possible attacker, that his guessed password was right.

  • Yes, but when would mod_rewrite do that? The users to be denied are identified by LDAP-group -- can mod_rewrite check membership? – Mikhail T. Feb 1 '17 at 18:11
  • @MikhailT. Can you post an example of what your current config looks like? – Dan Lowe Feb 1 '17 at 18:13
  • I added the sample config to my question – Mikhail T. Feb 1 '17 at 18:29
  • @MikhailT. Ah I see you are not using mod_rewrite here (the question's tags confused me on that point). I updated my answer. – Dan Lowe Feb 1 '17 at 18:43
  • Ah, awesome! I remembered there being such a thing somewhere from years back (the era of Apache-1.x), but could not find it. Thought, mod_rewrite is my only option... Thanks! – Mikhail T. Feb 1 '17 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.