You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Miguel González <mi...@yahoo.es> on 2013/05/21 09:50:39 UTC
[users@httpd] Authenticating with subfolders
Dear all,
I've been googling around and I haven't been able to find an answer
for this.
I have a web based software (Munin) which is password protected in
its root folder (my master user and password). However, since it
generates subfolders for each server and fill them with html files I
would like to be able to get those subfolders password protected too.
Each subfolder should have a different user and password and not let
users to be able to navigate to the root folder or to other servers. Of
course, the master password should still be able to traverse all folders.
Is that possible?
Thanks,
Miguel
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Authenticating with subfolders
Posted by Vincenzo D'Amore <v....@gmail.com>.
Hi Bruno,
As long as there's only one Authorization header, the client doesn't
> need to specify a realm, as the server knows what realm the access
> resource belongs to. But you're right in your analysis: the fact that
> the realm isn't specified in the client request makes it highly probable
> that you cannot specify several Authorization headers, as if that was
> possible, the server would have to guess the right login/password pair
> by trying all the Authorization headers until one of them works...
> Pretty flawed solution IMHO. ;-)
>
>
Right Bruno, when I was at lunch I was thinking the same thing, in case the
server will receive more Authorization headers, well... it will have an
embarrassing of riches :))
> Regards,
>
> Bruno
>
> --
> - Service Hydrographique et Oceanographique de la Marine - DMGS/INF
> - 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE
> - Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier@shom.fr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
--
Vincenzo D'Amore
email: v.damore@gmail.com
skype: free.dev
mobile: +39 349 8513251
Re: [users@httpd] Authenticating with subfolders
Posted by Bruno Tréguier <Br...@shom.fr>.
Le 21/05/2013 à 12:51, Vincenzo D'Amore a écrit :
> Hi Bruno,
Hi again Vincenzo,
> just read again the RFC you stated, I'm not sure about the assumption
> that a realm can be contained within another.
> Or may be the implementation done by Apache httpd cannot support
> multiple nested realms.
>
> As far as I see, you can define just one Realm that, eventually,
> override the existing one.
In fact, per RFC2616, a resource can only belong to one realm. The
question, then, is: to access a resource belonging to a certain realm,
are you allowed to cross other realms ?
As far as I can see, the answer seems to be no, but I may be wrong.
> This is from "Authentication and Authorization" (
> http://httpd.apache.org/docs/2.2/howto/auth.html )
>
> /The AuthName directive sets the Realm to be used in the authentication.
> The realm serves two major functions. First, the client often presents
> this information to the user as part of the password dialog box. Second,
> it is used by the client to determine what password to send for a given
> authenticated area./
Yes, that's exactly how it works in my opinion, but there seems to be a
little grey area in the fact that to access a resource within a realm,
you must (or not) cross the realms of higher level.
> On the other hand, I took a look at HTTP header during the conversation
> between server and agent.
> Well, the Agent, within its Request, sends an Authorization header quite
> simple.
> It don't even specify the realm, only type and credential:
>
> Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
>
> So I'm not sure it is possible have multiple realm.
As long as there's only one Authorization header, the client doesn't
need to specify a realm, as the server knows what realm the access
resource belongs to. But you're right in your analysis: the fact that
the realm isn't specified in the client request makes it highly probable
that you cannot specify several Authorization headers, as if that was
possible, the server would have to guess the right login/password pair
by trying all the Authorization headers until one of them works...
Pretty flawed solution IMHO. ;-)
Regards,
Bruno
--
- Service Hydrographique et Oceanographique de la Marine - DMGS/INF
- 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE
- Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier@shom.fr
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Authenticating with subfolders
Posted by Vincenzo D'Amore <v....@gmail.com>.
Hi Bruno,
just read again the RFC you stated, I'm not sure about the assumption that
a realm can be contained within another.
Or may be the implementation done by Apache httpd cannot support multiple
nested realms.
As far as I see, you can define just one Realm that, eventually, override
the existing one.
This is from "Authentication and Authorization" (
http://httpd.apache.org/docs/2.2/howto/auth.html )
*The AuthName directive sets the Realm to be used in the authentication.
The realm serves two major functions. First, the client often presents this
information to the user as part of the password dialog box. Second, it is
used by the client to determine what password to send for a given
authenticated area.*
On the other hand, I took a look at HTTP header during the conversation
between server and agent.
Well, the Agent, within its Request, sends an Authorization header quite
simple.
It don't even specify the realm, only type and credential:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
So I'm not sure it is possible have multiple realm.
Best,
Vincenzo
2013/5/21 Vincenzo D'Amore <v....@gmail.com>
> Hi Bruno,
>
> may be you're right, I read long time ago, but actually don't remember
> exactly the RFC.
> So now I have just implemented such configuration with Apache 2.2.
>
> Into the document root I have created a .htaccess with this configuration:
>
> AuthType Basic
> AuthName "Root Restricted Files"
> AuthBasicProvider file
> AuthUserFile /var/www/.htpasswd
> require valid-user
>
> After I created a directory /var/www/test1 where I have created a new
> .htaccess file with this configuration:
>
> AuthType Basic
> AuthName "Test1 Restricted Files"
> AuthBasicProvider file
> AuthUserFile /var/www/test1/.htpasswd
> require valid-user
>
> Into /var/www/.htpasswd there is:
>
> # htpasswd -bn root password
>
> root:UYMXijHR5MW42
>
> Into /var/www/test1/.htpasswd there is:
>
> # htpasswd -bn test1 password1
>
> test1:P5ENtSmla14FQ
>
> Well, it is working pretty well, please try it.
> I have also tried to add a third directory with different credential,
> every thinks works like a charm :)
>
> Best,
> Vincenzo
>
>
> 2013/5/21 Bruno Tréguier <Br...@shom.fr>
>
>> Le 21/05/2013 à 11:07, Vincenzo D'Amore a écrit :
>> > Hi Miguel,
>> >
>> > yes it is possible, you could add a couple of file in each directory
>> > (.htaccess and .htpasswd).
>> > Those files should override the root authentication configuration with a
>> > new local config.
>> >
>> > I suggest to read here how to implement such configuration:
>> >
>> > http://httpd.apache.org/docs/2.2/howto/auth.html
>>
>> Hello Vincenzo and Miguel,
>>
>> I've been looking for such a configuration as well long ago, and I had
>> come to the conclusion that it was not possible, as only *one*
>> Authorization header is allowed (as far as I know).
>>
>> RFC2616 (HTTP/1.1) also states, in its §14.8:
>>
>> "If a request is authenticated and a realm specified, the same
>> credentials SHOULD be valid for all other requests within this realm".
>>
>> So, as I undestand it, you cannot use a login/password pair for a local
>> resource accessible via, e.g., "/a/", and another login/password pair
>> for another local resources located "under", e.g. "/a/b/" (as accessing
>> /a/b/'s realm implies accessing "/a/'s realm first).
>>
>> I may be wrong, that being said, but if anyone has a solution for that,
>> I'd love to read how it was implemented.
>>
>> Regards,
>>
>> Bruno
>>
>> --
>> - Service Hydrographique et Oceanographique de la Marine - DMGS/INF
>> - 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE
>> - Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier@shom.fr
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>>
>
>
> --
> Vincenzo D'Amore
> email: v.damore@gmail.com
> skype: free.dev
> mobile: +39 349 8513251
>
--
Vincenzo D'Amore
email: v.damore@gmail.com
skype: free.dev
mobile: +39 349 8513251
Re: [users@httpd] Authenticating with subfolders
Posted by Miguel González <mi...@yahoo.es>.
On 21/05/2013 14:14, Vincenzo D'Amore wrote:
> Hi Miguel,
>
> when you get authenticated with test1 user, may be your server returns
> an html page that have more resources inside (i mean css, js, img),
> and very likely, some of them are into the root Realm. This could
> explain why you get prompted for the root password too.
That makes sense, how can I avoid that? My guess is that I have to make
those css and img files access not restricted by authentication, isn't it?
Regards,
Miguel
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Authenticating with subfolders
Posted by Vincenzo D'Amore <v....@gmail.com>.
Hi Miguel,
when you get authenticated with test1 user, may be your server returns an
html page that have more resources inside (i mean css, js, img), and very
likely, some of them are into the root Realm. This could explain why you
get prompted for the root password too.
Best,
Vincenzo
2013/5/21 Miguel González <mi...@yahoo.es>
>
>
>
> On 21/05/2013 12:27, Vincenzo D'Amore wrote:
>
>> Hi Bruno,
>>
>> may be you're right, I read long time ago, but actually don't remember
>> exactly the RFC.
>> So now I have just implemented such configuration with Apache 2.2.
>>
>> Into the document root I have created a .htaccess with this configuration:
>>
>> AuthType Basic
>> AuthName "Root Restricted Files"
>> AuthBasicProvider file
>> AuthUserFile /var/www/.htpasswd
>> require valid-user
>>
>> After I created a directory /var/www/test1 where I have created a new
>> .htaccess file with this configuration:
>>
>> AuthType Basic
>> AuthName "Test1 Restricted Files"
>> AuthBasicProvider file
>> AuthUserFile /var/www/test1/.htpasswd
>> require valid-user
>>
>> Into /var/www/.htpasswd there is:
>>
>> # htpasswd -bn root password
>>
>> root:UYMXijHR5MW42
>>
>> Into /var/www/test1/.htpasswd there is:
>>
>> # htpasswd -bn test1 password1
>>
>> test1:P5ENtSmla14FQ
>>
>> Well, it is working pretty well, please try it.
>> I have also tried to add a third directory with different credential,
>> every thinks works like a charm :)
>>
>
> Well, I have Apache 2.2.15. What you have showed in your configs is what I
> have already tried myself and It doesn't work for me.
>
> When I get authenticated with test1 user, I get another prompt for
> entering the root password as well. If I cancel, I get some sort of
> degraded version of the index in the root folder which doesn't make sense
> to me
>
> Regards,
>
> Miguel
>
>
> ------------------------------**------------------------------**---------
> To unsubscribe, e-mail: users-unsubscribe@httpd.**apache.org<us...@httpd.apache.org>
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
--
Vincenzo D'Amore
email: v.damore@gmail.com
skype: free.dev
mobile: +39 349 8513251
Re: [users@httpd] Authenticating with subfolders
Posted by Miguel González <mi...@yahoo.es>.
On 21/05/2013 12:27, Vincenzo D'Amore wrote:
> Hi Bruno,
>
> may be you're right, I read long time ago, but actually don't remember
> exactly the RFC.
> So now I have just implemented such configuration with Apache 2.2.
>
> Into the document root I have created a .htaccess with this configuration:
>
> AuthType Basic
> AuthName "Root Restricted Files"
> AuthBasicProvider file
> AuthUserFile /var/www/.htpasswd
> require valid-user
>
> After I created a directory /var/www/test1 where I have created a new
> .htaccess file with this configuration:
>
> AuthType Basic
> AuthName "Test1 Restricted Files"
> AuthBasicProvider file
> AuthUserFile /var/www/test1/.htpasswd
> require valid-user
>
> Into /var/www/.htpasswd there is:
>
> # htpasswd -bn root password
>
> root:UYMXijHR5MW42
>
> Into /var/www/test1/.htpasswd there is:
>
> # htpasswd -bn test1 password1
>
> test1:P5ENtSmla14FQ
>
> Well, it is working pretty well, please try it.
> I have also tried to add a third directory with different credential,
> every thinks works like a charm :)
Well, I have Apache 2.2.15. What you have showed in your configs is what
I have already tried myself and It doesn't work for me.
When I get authenticated with test1 user, I get another prompt for
entering the root password as well. If I cancel, I get some sort of
degraded version of the index in the root folder which doesn't make
sense to me
Regards,
Miguel
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Authenticating with subfolders
Posted by Vincenzo D'Amore <v....@gmail.com>.
Hi Bruno,
may be you're right, I read long time ago, but actually don't remember
exactly the RFC.
So now I have just implemented such configuration with Apache 2.2.
Into the document root I have created a .htaccess with this configuration:
AuthType Basic
AuthName "Root Restricted Files"
AuthBasicProvider file
AuthUserFile /var/www/.htpasswd
require valid-user
After I created a directory /var/www/test1 where I have created a new
.htaccess file with this configuration:
AuthType Basic
AuthName "Test1 Restricted Files"
AuthBasicProvider file
AuthUserFile /var/www/test1/.htpasswd
require valid-user
Into /var/www/.htpasswd there is:
# htpasswd -bn root password
root:UYMXijHR5MW42
Into /var/www/test1/.htpasswd there is:
# htpasswd -bn test1 password1
test1:P5ENtSmla14FQ
Well, it is working pretty well, please try it.
I have also tried to add a third directory with different credential, every
thinks works like a charm :)
Best,
Vincenzo
2013/5/21 Bruno Tréguier <Br...@shom.fr>
> Le 21/05/2013 à 11:07, Vincenzo D'Amore a écrit :
> > Hi Miguel,
> >
> > yes it is possible, you could add a couple of file in each directory
> > (.htaccess and .htpasswd).
> > Those files should override the root authentication configuration with a
> > new local config.
> >
> > I suggest to read here how to implement such configuration:
> >
> > http://httpd.apache.org/docs/2.2/howto/auth.html
>
> Hello Vincenzo and Miguel,
>
> I've been looking for such a configuration as well long ago, and I had
> come to the conclusion that it was not possible, as only *one*
> Authorization header is allowed (as far as I know).
>
> RFC2616 (HTTP/1.1) also states, in its §14.8:
>
> "If a request is authenticated and a realm specified, the same
> credentials SHOULD be valid for all other requests within this realm".
>
> So, as I undestand it, you cannot use a login/password pair for a local
> resource accessible via, e.g., "/a/", and another login/password pair
> for another local resources located "under", e.g. "/a/b/" (as accessing
> /a/b/'s realm implies accessing "/a/'s realm first).
>
> I may be wrong, that being said, but if anyone has a solution for that,
> I'd love to read how it was implemented.
>
> Regards,
>
> Bruno
>
> --
> - Service Hydrographique et Oceanographique de la Marine - DMGS/INF
> - 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE
> - Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier@shom.fr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
--
Vincenzo D'Amore
email: v.damore@gmail.com
skype: free.dev
mobile: +39 349 8513251
Re: [users@httpd] Authenticating with subfolders
Posted by Bruno Tréguier <Br...@shom.fr>.
Le 21/05/2013 à 11:07, Vincenzo D'Amore a écrit :
> Hi Miguel,
>
> yes it is possible, you could add a couple of file in each directory
> (.htaccess and .htpasswd).
> Those files should override the root authentication configuration with a
> new local config.
>
> I suggest to read here how to implement such configuration:
>
> http://httpd.apache.org/docs/2.2/howto/auth.html
Hello Vincenzo and Miguel,
I've been looking for such a configuration as well long ago, and I had
come to the conclusion that it was not possible, as only *one*
Authorization header is allowed (as far as I know).
RFC2616 (HTTP/1.1) also states, in its §14.8:
"If a request is authenticated and a realm specified, the same
credentials SHOULD be valid for all other requests within this realm".
So, as I undestand it, you cannot use a login/password pair for a local
resource accessible via, e.g., "/a/", and another login/password pair
for another local resources located "under", e.g. "/a/b/" (as accessing
/a/b/'s realm implies accessing "/a/'s realm first).
I may be wrong, that being said, but if anyone has a solution for that,
I'd love to read how it was implemented.
Regards,
Bruno
--
- Service Hydrographique et Oceanographique de la Marine - DMGS/INF
- 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE
- Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier@shom.fr
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Authenticating with subfolders
Posted by Vincenzo D'Amore <v....@gmail.com>.
Hi Miguel,
yes it is possible, you could add a couple of file in each directory
(.htaccess and .htpasswd).
Those files should override the root authentication configuration with a
new local config.
I suggest to read here how to implement such configuration:
http://httpd.apache.org/docs/2.2/howto/auth.html
Best,
Vincenzo
2013/5/21 Miguel González <mi...@yahoo.es>
> Dear all,
>
> I've been googling around and I haven't been able to find an answer for
> this.
>
> I have a web based software (Munin) which is password protected in its
> root folder (my master user and password). However, since it generates
> subfolders for each server and fill them with html files I would like to be
> able to get those subfolders password protected too. Each subfolder should
> have a different user and password and not let users to be able to navigate
> to the root folder or to other servers. Of course, the master password
> should still be able to traverse all folders.
>
> Is that possible?
>
> Thanks,
>
> Miguel
>
> ------------------------------**------------------------------**---------
> To unsubscribe, e-mail: users-unsubscribe@httpd.**apache.org<us...@httpd.apache.org>
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
--
Vincenzo D'Amore
email: v.damore@gmail.com
skype: free.dev
mobile: +39 349 8513251