Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

what would be the correct config to allow only authenticated users and the intranet (without need for a password) in apache? This does not request a password and without the "satisfy any" intranet users are also required to enter a password...

<Directory "/var/www">
#   Allow Network Access and/or Basic Auth
Satisfy any

allow from 192.168

AuthName "Enter passwd!"
require valid-user
AuthUserFile /var/.passwd
AuthType Basic
allow from all
order deny,allow
</Directory>
share|improve this question
    
This should work, your satisfy any should do the trick: either the IP is 192.168.xxx.xxx or a password is entered. –  Konerak Sep 9 '11 at 16:26
add comment

migrated from stackoverflow.com Sep 11 '11 at 8:22

This question came from our site for professional and enthusiast programmers.

2 Answers

Try putting

satisfy any
order deny,allow
deny from all

at the top instead of at the bottom:

<Directory "/var/www">
#   Allow Network Access and/or Basic Auth
order deny,allow
Satisfy any

allow from 192.168

AuthName "Enter passwd!"
require valid-user
AuthUserFile /var/.passwd
AuthType Basic

deny from all    
</Directory>
share|improve this answer
    
With this I am getting in without any password... –  Magreet Sep 9 '11 at 20:12
    
Well, are you on 192.168? Then that was the point, no? And end it with a deny all. –  Konerak Sep 11 '11 at 7:18
    
No, I tried it from my cell phone. Sry for the account mix up. -Magreet –  user376244 Sep 11 '11 at 14:44
add comment

But let's say you want people from your LAN to have full access, without being prompted for a password. In this scenario we could use:

<Directory /home/www/site1/private>
  AuthUserFile /home/www/site1-passwd
  AuthType Basic
  AuthName MySite
  Require valid-user
  Order allow,deny
  Allow from 172.17.10
  Satisfy any
</Directory>

This will force everyone from the outside to authenticate, but those coming from the LAN IP range would not be required to do so. Apache will let them access the directory without authenticating. You can add other hostnames (local or remote) to the Allow directive to give them access to the directory as well. See the Apache Docs on Allow.

From apache wiki http://wiki.apache.org/httpd/BypassAuthenticationOrAuthorizationRequirements

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.