Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that OpenSSO allows for an Exclusion List, but I'm wondering if Basic Auth will still be enforced by the Apache webserver?

For example, this is what I would like to happen, I'm just not sure if it would actually work:

  1. User requests url.com/open_area

  2. OpenSSO recognizes that open_area should be left unprotected.

  3. open_area is protected by an ACL in Apache, so Apache denies with response 401, or accept if Authorization string in Http Request is correct.

share|improve this question
1  
You should always test your security systems. –  Rook Mar 29 '11 at 16:22
add comment

1 Answer

Yes, you can combine several authentication methods using the Satisfy {any|all} directive.

To apply BasicAuth only on some URLs, matching a pattern:

SetEnvIf Request_URI ^/webservice/* do_basic_auth
<IfDefine do_basic_auth>
    AuthName "Authentication"
    AuthType Basic
    AuthUserFile /somewhere/.htpasswd
    Require valid-user
</IfDefine>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.