apache2: Require valid-user for everything except "special_page"

Question

With Apache2 how may I require a valid user for every page except these special pages which can be seen by anybody?

Thanks in advance for your thoughts.

Update in response to comments; here is a working apache2 config:

<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    Order allow,deny
    allow from all
</Directory>

# require authentication for everything not specificly excepted
<Location / >
    AuthType Basic
    AuthName "whatever"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user
    AllowOverride all                       
</Location>

# allow standard apache icons to be used without auth (e.g. MultiViews)
<Location /icons>
    allow from all
    Satisfy Any
</Location>

# anyone can see pages in this tree
<Location /special_public_pages>
    allow from all
    Satisfy Any
</Location>

did you actually checked what's happening on the wire or at least in logs? isn't that your browser asking ag for /favicon.ico what triggers credentials request? — pQd, Jan 06 '10 at 09:32
ahhh, that pointed me in the right direction. Favicon doesn't appear to need authentication or exception, but /icons/* for MultiViews does. Thanks! — matt wilkie, Jan 06 '10 at 23:48

score 4 · Accepted Answer · answered Dec 23 '09 at 23:38

4

this should do a trick:

<Location / >
 AuthType Basic
 AuthName "whatever"
 AuthUserFile /etc/apache2/htpasswd
 Require valid-user
 AllowOverride all                       
</Location>

<Location /yourspecial>
 allow from all
 Satisfy Any
</Location>

satisfy any is the cruicial one..

answered Dec 23 '09 at 23:38

pQd

29,981
6
66
109

except `satisfy` is not valid for `` :( – matt wilkie Dec 29 '09 at 02:38
@matt wilkie - believe me or not - this is tested working config. – pQd Dec 29 '09 at 06:37
@pQd hmm, it appears in this instance the documentation is wrong. Thanks for the help – matt wilkie Jan 05 '10 at 22:16
sorry, I have to retract the accepted answer status. I thought it was working but when I went to a different machine the "popup auth dialog first then show the special page" behaviour reasserted itself. – matt wilkie Jan 05 '10 at 22:51
did you checked what happens at http level [ with fiddler of wireshark ]? are you sure it's not a problem of missing / at the end of url? – pQd Jan 05 '10 at 23:11
I've updated the question to include full details of my current setup – matt wilkie Jan 05 '10 at 23:47

apache2: Require valid-user for everything except "special_page"

1 Answers1