How to restrict proxied apps based on application auth logic

Question

I have a vhost with mod proxy that redirects fine, but I’d like to add to it.

Here’s my vhost:

<VirtualHost *:80>

    ServerName www.domaine.local

    ProxyRequests Off
    ProxyPreserveHost On

    ProxyPass /subsonic/ http://serv2.domaine.local/subsonic/
    ProxyPassReverse /subsonic/ http://serv2.domaine.local/subsonic/

    ProxyPass /owncloud/ http://serv3.domaine.local/owncloud/
    ProxyPassReverse /owncloud/ http://serv3.domaine.local/owncloud/

    ProxyPass / http://serv1.domaine.local/
    ProxyPassReverse / http://serv1.domaine.local/

</VirtualHost>

In serv1 I have my own php/mysql/ldap application, which authenticates my users. One of my rules is : 1 user can access 0,1 or N apps.

So i would like that for example :

a non authenticated user can have just this part of the reverse proxy vhost:

ProxyPass / http://serv1.domaine.local/                              
ProxyPassReverse / http://serv1.domaine.local/

a user that is allowed access to only one app ("subsonic") would have access to:

ProxyPass / http://serv1.domaine.local/                              
ProxyPassReverse / http://serv1.domaine.local/

AND

ProxyPass /subsonic/ http://serv2.domaine.local/subsonic/
ProxyPassReverse /subsonic/ http://serv2.domaine.local/subsonic/

a "all access" user can access all defined proxies

I don't know how to do that, perhaps i could put for example a variable $_SESSION['authtothisapp'] = true ; in my php application, but how to say to apache if $_SESSION['authtothisapp'] = true then allow access to a given proxied app?

The way your formatted this question is very confusing. I suggest you approve the pending edit to improve the formatting. — kasperd, Dec 14 '14 at 15:23

score 0 · Answer 1 · answered Dec 16 '14 at 22:37

On a global proxy level I've done it using session cookies like this:

<Proxy *>
  Order deny,allow
  Deny from all
  SetEnvIf Cookie "authtoken=myCookie" let_me_in
  Allow from env=let_me_in
</Proxy>

You may be able to restrict access to individual directories based on cookies using explicit URLS in the Proxy config like this:

 <Proxy http://example.com/foo/*>

But I have not personally tested that option.

How to restrict proxied apps based on application auth logic

1 Answers1