You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Joshua Slive <js...@gmail.com> on 2005/10/13 15:32:37 UTC
Re: [users@httpd] How to prevent AuthBasic login pop-up after first failed login attempt
On 10/13/05, Martin Knoblauch <sp...@knobisoft.de> wrote:
> Hi,
>
> for a secured webserver, I have the following setup/requirements
>
> a) HTTPS access only
> b) Clients need certificate
> c) for different parts of the site, I want to restrict access to
> certain certificates.
>
> a) and b) work great. c) works mostly. I am using the SSLOption
> "FakeBasicAuth" to extract the DN from the certificate and check them
> against a htpasswd file. This works as expected when one of the
> "valid-users" is trying to request the page. If one with a valid
> certificate, but nonmatching DN comes along he is not let in (GOOD !!),
> but gets the log in pop-up (BAD !!). In that case I would like to
> immediately send the "forbidden" response. Is than possible at all?
This is just a guess, since I have never used FakeBasicAuth, but you might try
ErrorDocument 401 http://yoursite.example.com/errorpage.html
This will probably generate a warning in the error_log, since 401
error documents aren't supposed to be absolute URLs. But in this
case, the effect of hiding the 401 status code is exactly what you
want, so you can ignore the warning.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] How to prevent AuthBasic login pop-up after first failed login attempt
Posted by Joshua Slive <js...@gmail.com>.
On 10/13/05, Martin Knoblauch <sp...@knobisoft.de> wrote:
> Sorry, but does not help. On startup httpd tells me that
> ErrorDocuments cannot be URL's (notice level) and the behaviour stays
> the same.
Looking at the code, it seems to throw out the errordocument, rather
than just warning about it. An alternative would be to point the
ErrorDocument 401 at a CGI script, which could then change the status
code. As you've noticed, it is the 401 response code that causes the
popup, so anything you can do to get of that will fix the problem.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to prevent AuthBasic login pop-up after first failed login attempt
Posted by Martin Knoblauch <sp...@knobisoft.de>.
--- Joshua Slive <js...@gmail.com> wrote:
> On 10/13/05, Martin Knoblauch <sp...@knobisoft.de> wrote:
> > Hi,
> >
> > for a secured webserver, I have the following setup/requirements
> >
> > a) HTTPS access only
> > b) Clients need certificate
> > c) for different parts of the site, I want to restrict access to
> > certain certificates.
> >
> > a) and b) work great. c) works mostly. I am using the SSLOption
> > "FakeBasicAuth" to extract the DN from the certificate and check
> them
> > against a htpasswd file. This works as expected when one of the
> > "valid-users" is trying to request the page. If one with a valid
> > certificate, but nonmatching DN comes along he is not let in (GOOD
> !!),
> > but gets the log in pop-up (BAD !!). In that case I would like to
> > immediately send the "forbidden" response. Is than possible at all?
>
> This is just a guess, since I have never used FakeBasicAuth, but you
> might try
> ErrorDocument 401 http://yoursite.example.com/errorpage.html
> This will probably generate a warning in the error_log, since 401
> error documents aren't supposed to be absolute URLs. But in this
> case, the effect of hiding the 401 status code is exactly what you
> want, so you can ignore the warning.
>
> Joshua.
>
Sorry, but does not help. On startup httpd tells me that
ErrorDocuments cannot be URL's (notice level) and the behaviour stays
the same.
Looking a bit more on this I would say that instead of sending 401, I
want to send 403 in the described case.
I just found a kind of very ugly workaround. If I add:
AuthAuthoritative Off
to the section, the server will reply with 500. Not sure whether this
is just a "feature", but it solves the reapearing pop-up problem.
Thanks
Martin
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org