htaccess directory protection in Apache 2.4

Question

I'm trying to work out how to protect a folder in Apache 2.4.

I have this part working fine:

AuthUserFile   /home/test/web/site.com/cgi-bin/hotels/admin/.htpasswd
AuthGroupFile  /dev/null
AuthType       Basic
AuthName       Protected

require valid-user

...but I also want to add the option of allowing me in without having to login. This is what I had on my old server:

Order Deny,Allow
Deny from all
Allow from 123.123.123.123
Satisfy Any

but the new one gives an error:

client denied by server configuration: /home/test/web/site.com/cgi-bin/hotels/admin/admin.cgi

Looking at https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration , I would have assumed this would work:

Require all denied
Allow from 123.123.123.123
Satisfy Any

...but it doesn't seem to (doesn't even ask for a login now, even when I change the accepted IP to a random one)

What am I missing?

Answer 1

Do not mix 2.2 and 2.4 directives like that. Satisfy/Order/Allow/Deny are all 2.2.x

Use 2.4 only and unload mod_access_compat:

AuthType Basic
AuthName "Authorized Users Only"
AuthBasicProvider file
AuthUserFile /home/test/web/site.com/cgi-bin/hotels/admin/.htpasswd
<RequireAny>
Require valid-user
Require ip 123.123.123.123
</RequireAny>

Note: htaccess has nothing to do with directory protection, if you have access to the main configuration files of the apache httpd server, define these all inside a <Directory /filesystem/path/to/protected/dir> tag

Note2: Forgot to mention, RequireAny has been specified for example purposes, but that is the default behaviour in 2.4.x so you do not really need to specify it if you don't want.