mod rewrite and auth

is it possible to use auth on a "virtual" directory created by mod_rewrite

[the_keithm]

I have an apache server that was initially set up for intranet access, so I didn't have to worry much about locking it down.

Later on, I needed to open it up to the internet, so I put an ldap authentication directive in the <Directory "/var/www/html"> section of the httpd.conf like so:

Order allow,deny

AuthBasicProvider ldap
AuthType Basic
AuthzLDAPAuthoritative on
AuthName "MyCompany Intranet"
AuthLDAPURL "ldap://myldapserver.mydomain.com:389/CN=Users,DC=mydomain,DC=com?sAMAccountName?sub?(memberOf=CN=Everyone at MyCompany,OU=MyCompany Groups,DC=mydomain,DC=com)" NONE
AuthLDAPBindDN "CN=Administrator,CN=Users,DC=mydomain,DC=com"
AuthLDAPBindPassword "MyPassword"

Require valid-user

# Allow from all
Allow from 192.168.1
Allow from 10.254.0

Satisfy any

This basically made it so that local users could get in with no password, and external users had to authenticate against our ADS domain to get in.

Now things get more complicated.

I have an app that I run that distinguishes between users by appending a cgi variable to the end of a URL, so I added the following rewrite rule into my httpd.conf (inside the <Directory /var/www/html> section).

RewriteEngine on
RewriteBase /
RewriteRule ^foo/(.*)$ some/really/long/url/$1?tenant_filter=2 [L]
RewriteRule ^bar/(.*)$ some/really/long/url/$1?tenant_filter=1 [L]

This works really great. Clients type in

http://myserver.mydomain.com/foo/file.html and the URL magically points them at

http://myserver.mydomain.com/some/really/long/url/file.html?tenant_filter=2 while all they see is the

http://myserver.mydomain.com/foo/file.html.

Here's where the problem comes in.

I'd like to define *separate* authentication parameters for the /foo and /bar virtual directories. No matter what I try, the authentication is always overridden by the ldap setup in my http.conf above. What am I doing wrong and what can I do to achieve my goal? Is it even possible?

[wilderness]

suggested reading:

The difference between internal rewrites and external redirects.
As well as the precedence of order in application of same.

[jdMorgan]

You may need to make real "foo" and "bar" directories and put a .htaccess file in each to override LDAP. Those .htaccess files can then do the rewrite to your script.

Alternately, define <Directory> containers and put the different auth configurations into each.

Jim

[the_keithm]

Thanks JD. That's kinda the path I was going down, so I appreciate the validation. Still banging my head on it, but I'll get there.

[the_keithm]

The solution to this problem was to create target directories in /var/www/html called foo and bar. Authentication was then setup for the directories in the /etc/httpd/conf.d directories as below:

<Directory "/var/www/html/bar" >

AuthBasicProvider ldap
AuthType Basic
AuthName "Bar Extranet"
AuthLDAPURL ldap://myldapserver.mydomain.com:3268/DC=mydomain,DC=com?sAMAccountName?sub?(objectClass=*)
AuthzLDAPAuthoritative on

AuthLDAPBindDN "CN=Administrator,CN=Users,DC=mydomain,DC=com"
AuthLDAPBindPassword "mypassword"

AuthLDAPGroupAttributeIsDN on

require ldap-group CN=Bar Kiosk,OU=mycompany Groups,DC=mydomain,DC=com

Allow from 192.168.1
Allow from 10.254.0

Satisfy any

</Directory>


The target directory of the rewrites was set to accept authentication from either foo or bar as below:

<Directory /var/www/html/some/really/long/directoryname >

AuthBasicProvider ldap
AuthType Basic
AuthName "mycompany Extranet"
AuthLDAPURL ldap://myldaphost.mydomain.com:3268/DC=mydomain,DC=com?sAMAccountName?sub?(objectClass=*)
AuthzLDAPAuthoritative on

AuthLDAPBindDN "CN=Administrator,CN=Users,DC=mydomain,DC=com"
AuthLDAPBindPassword "mypassword"

AuthLDAPGroupAttributeIsDN on

require ldap-group CN=Domain Users,CN=Users,DC=mydomain,DC=com
require ldap-group CN=BAR Kiosk,OU=mycompany Groups,CN=Users,DC=mydomain,DC=com

Allow from 192.168.1
Allow from 10.254.0

satisfy any

</Directory>

Although this allows both foo and bar to access the target directory, it is sufficient for my needs, as the target directory is obfuscated by the URL rewrite code.

I also changed the code in the /etc/httpd/conf/httpd.conf file for the URL rewrites to prevent loops:

RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} !^(.*)tenant_filter=1$ [OR]
RewriteCond %{REQUEST_URI} !^(.*)tenant_filter=2$
RewriteRule ^foo/(.*)$ some/really/long/url/$1?tenant_filter=2 [L]
RewriteRule ^bar/(.*)$ some/really/long/url/$1?tenant_filter=1 [L]

Lastly, my situation was complicated by the fact that I am running BlueDragon 7.1 for Linux on that server. I did not mention it in my initial post, but BD was not recognizing some of the changes I was making in my Apache configs without being restarted. This greatly complicated the process.

[jdMorgan]

Be aware that your RewriteConds only affect the single RewriteRule that follows them. Therefore, in the code posted immediately above, the rule to rewrite "foo" is qualified by the "tenant_filter" RewriteConds, while the rule for "bar" is not.

If you need to qualify the requests for "bar", then you will need to duplicate the RewriteConds for that rule.

Jim

[the_keithm]

Wow thank you for the insight on that jd. I am obviously a n00b at this.

[jdMorgan]

depending on exactly what you're trying to do, you may be able to "compress" the code, and replace

RewriteCond %{REQUEST_URI} !^(.*)tenant_filter=1$ [OR]
RewriteCond %{REQUEST_URI} !^(.*)tenant_filter=2$

with

RewriteCond %{REQUEST_URI} !tenant_filter=[12]$

if the 'filter' values in your example are literally "1" and "2".

If so, then duplicating the RewriteConds isn't so wasteful.

Jim

[the_keithm]

Thanks Jd. Your feedback has been amazingly helpful and greatly appreciated.