Your idea would be easily doable by means of a small "set-userID-root" program which would only perform a setgroups(2) with all the current groups (as per getgroups(2)) except the sudo one, effectively dropping it. The set-userID-root is required because setgroups(2) is a privileged operation.
On Linux it could even be simpler as you could leverage ...
This isn't a definitive answer but I can report how I fixed it.
All http requests were redirected to https, though I'm not clear where that was done. This meant that the vhosts for *:80 were ignored and the *:443 ones were the ones used. I moved the auth stuff to the *:443 vhost and preceded it with a "Require all denied" and it now requests the ...
The VMs in public cloud does not have access to your laptop's USB port. You may use ssh authentication based on the certificate inside your smartcard.
Please have a look at Putty-CAC project.
Here there is a detailed setup tutorial
This is a common issue. The Apache documentation suggests using the <Location /> directive instead of <Directory />. The following example VirtualHost should provide you with functional Basic Authentication: