Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that OpenSSO allows for an Exclusion List, but I'm wondering if Basic Auth will still be enforced by the Apache webserver?
For example, this is what I would like to happen, I'm just not sure if it would actually work:
User requests url.com/open_area
OpenSSO recognizes that open_area should be left unprotected.
open_area is protected by an ACL in Apache, so Apache denies with response 401, or accept if Authorization string in Http Request is correct.