You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jack Simmons <go...@mail.ru.INVALID> on 2019/09/27 14:30:01 UTC
[users@httpd] Basic Authorization & autoindex enabling
Good day everyone! I've got a question related to Basic Authorization and Home directory detection. Namely, I want to configure the webserver in such a way that it allows to do autoindex if user is browsing their home directory. I tried to declare an environment variable first, but then realized that I am unable to use it inside If directive.
For example:
SetEnvIf Request_URI ^/(.*)/ URI_HOME=$1
SetEnvIf Authorization "^Basic (.*)$" X_HTTP_AUTHORIZATION=$1
SetEnvIfExpr "unbase64(%{ENV:X_HTTP_AUTHORIZATION}) -strcmatch '%{ENV:URI_HOME}:*'" USER_IS_IN_HOME_DIR
Then it tried to put the extraction of username info If clause. But I cannot figure out how to use regexp inside it or some substring function to remove "Basic " prefix.
I have seen how it is done on wiki page:
https://cwiki.apache.org/confluence/display/httpd/LogBasicauthenticationusername
But again, RequestHeader runs after any If directove so I am unable to configure Autoindex for my purposes.
Any ideas how it can be done?
Re: [users@httpd] Basic Authorization & autoindex enabling
Posted by Ruben Safir <mr...@panix.com>.
On 9/27/19 10:30 AM, Jack Simmons wrote:
> Good day everyone! I've got a question related to Basic Authorization and Home directory detection. Namely, I want to configure the webserver in such a way that it allows to do autoindex if user is browsing their home directory. I tried to declare an environment variable first, but then realized that I am unable to use it inside If directive.
>
> For example:
>
> SetEnvIf Request_URI ^/(.*)/ URI_HOME=$1
> SetEnvIf Authorization "^Basic (.*)$" X_HTTP_AUTHORIZATION=$1
> SetEnvIfExpr "unbase64(%{ENV:X_HTTP_AUTHORIZATION}) -strcmatch '%{ENV:URI_HOME}:*'" USER_IS_IN_HOME_DIR
>
> Then it tried to put the extraction of username info If clause. But I cannot figure out how to use regexp inside it or some substring function to remove "Basic " prefix.
> I have seen how it is done on wiki page:
> https://cwiki.apache.org/confluence/display/httpd/LogBasicauthenticationusername
> But again, RequestHeader runs after any If directove so I am unable to configure Autoindex for my purposes.
> Any ideas how it can be done?
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
https://httpd.apache.org/docs/2.4/env.html
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive
http://www.coinhangout.com - coins!
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re[2]: [users@httpd] Basic Authorization & autoindex enabling
Posted by Jack Simmons <go...@mail.ru.INVALID>.
Dude, what are you talking about?
The user's credentials are encoded into the HTTP request header "Authorization". In my question I showed how one can unencode it and compare against part of the path at the same HTTP request.
I already figured out how to solve my problem, BTW. I did it with directive LocationMatch with regexp detecting slashes at the end of the location (and Indexes option enabled) and using authorization containter via RequireAll, with two conditions (one is using env. variable setted up earlier).
But what are YOU talking about?.. Who the hell is using .htaccess anyways? It is obsolete as hell.
And the question was how to enable autoindex for a certain user if it is browsing their home directory. Please read the topic before answering next time.
Re: [users@httpd] Basic Authorization & autoindex enabling
Posted by Ruben Safir <mr...@panix.com>.
apache doesn't know the user. The user would have to log in itentify
themselves first.
you can drop authentication into ./.htaccess in the defined user root
directors
On 9/27/19 10:30 AM, Jack Simmons wrote:
> Good day everyone! I've got a question related to Basic Authorization and Home directory detection. Namely, I want to configure the webserver in such a way that it allows to do autoindex if user is browsing their home directory. I tried to declare an environment variable first, but then realized that I am unable to use it inside If directive.
>
> For example:
>
> SetEnvIf Request_URI ^/(.*)/ URI_HOME=$1
> SetEnvIf Authorization "^Basic (.*)$" X_HTTP_AUTHORIZATION=$1
> SetEnvIfExpr "unbase64(%{ENV:X_HTTP_AUTHORIZATION}) -strcmatch '%{ENV:URI_HOME}:*'" USER_IS_IN_HOME_DIR
>
> Then it tried to put the extraction of username info If clause. But I cannot figure out how to use regexp inside it or some substring function to remove "Basic " prefix.
> I have seen how it is done on wiki page:
> https://cwiki.apache.org/confluence/display/httpd/LogBasicauthenticationusername
> But again, RequestHeader runs after any If directove so I am unable to configure Autoindex for my purposes.
> Any ideas how it can be done?
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive
http://www.coinhangout.com - coins!
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org