How to set up authentication for the personal userdir in Apache?

Question

I set up authentication on my personal public_html in my home dir, but it takes no effect. Ie., I should get a pop-up asking for my credentials, but this doesn't happen. The authentication worked fine with a directory in the server's root directory, and it worked ok. Now I'm restructuring the server.

Here are some more details. There are a few side problems and questions related to the config file, which I put in bold.

• I have the main HTTP directory in /var/www/html and the same for HTTPS.
• There's only one file there, index.html with a link to my personal ~tomas URL. It works fine. I'm using the userdir mod for mapping ~tomas.
• I also have a personal cgi-bin directory, and the CGIs work ok, but I would like the URL ~tomas/cgi-bin to show the directory listing, which doesn't work for some reason and I get 403 Forbidden.
• I want to have the main directory available in both HTTPS and HTTP and with no authorisation. But once the client requests one of the personal public_html directories through ~user, the access should be authenticated and the authentication should take place over HTTPS. So HTTP needs to switch to HTTPS. I've already set up and tested HTTPS facilities, but have not yet set up any enforcement in this context. I have no FQDN if it matters.

The main question is nevertheless, how to get the authentication itself work for ~user, even over HTTP.

I put all the configs in userdir.conf and I guess the problem is with using the wildcard in /home/*/public_html.

Here's the userdir.conf.

<IfModule mod_userdir.c>
        UserDir "public_html"
        UserDir disabled
        UserDir enabled tomas

        <Directory "/home/*/public_html">
                AllowOverride FileInfo AuthConfig Limit Indexes
                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
                <Limit GET POST OPTIONS>
                        Require all granted
                </Limit>
                <LimitExcept GET POST OPTIONS>
                        Require all denied
                </LimitExcept>
                AuthType Basic
                AuthName "Personal HTML"
                AuthUserFile "/usr/share/apache2/passwd/passwords"
                Require valid-user
                SSLOptions +StdEnvVars
        </Directory>

        <Directory "/home/*/public_html/cgi-bin">
                Options ExecCGI Indexes
                SetHandler cgi-script
        </Directory>
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

If you have any comments on this config file or about my approach to Apache in general, please do comment.

Answer 1

The key is the Limit directive. The clue is present in the <Limit> Directive section of the core mod Apache doc page.

When using <Limit> or <LimitExcept> directives with the Require directive, note that the first Require to succeed authorizes the request, regardless of the presence of other Require directives.

As it turns out, the first Require that matches the case at hand decides how it's processed. With the config from my question, that is:

            <Limit GET POST OPTIONS>
                    Require all granted
            </Limit>
            <LimitExcept GET POST OPTIONS>
                    Require all denied
            </LimitExcept>
            AuthType Basic
            AuthName "Personal HTML"
            AuthUserFile "/usr/share/apache2/passwd/passwords"
            Require valid-user

with a simple GET request, it's the Require all granted in the second line of the listing above that does the thing. The AuthType Basic and other lines below it are dead code. A right way to go is:

            <Limit GET POST OPTIONS>
                    AuthType Basic
                    AuthName "Personal HTML"
                    AuthUserFile "/usr/share/apache2/passwd/passwords"
                    Require valid-user
            </Limit>
            <LimitExcept GET POST OPTIONS>
                    Require all denied
            </LimitExcept>

As an aside, here's a case when the Limit directive is ignored.

            Require all granted
            <Limit GET POST OPTIONS>
                    AuthType Basic
                    AuthName "Personal HTML"
                    AuthUserFile "/usr/share/apache2/passwd/passwords"
                    Require valid-user
            </Limit>
            <LimitExcept GET POST OPTIONS>
                    Require all denied
            </LimitExcept>

The first line succeeds and authorises the request.