This is a discussion on Authentication Question (SSL + Basic) within the Apache Web Server forums, part of the Web Server and Related Forums category; I'm setting up a RESTful web service and want GET to be open to all with only PUT, POST, ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
I'm setting up a RESTful web service and want GET to be open to all
with only PUT, POST, and DELETE restricted to registered users. Ideally I would like to both be able to ask for a username/password for these resources using Basic Auth and be able to use SSL certificates for those users that want them. I'm using Apache 2.2. The problem is I can make the Basic Auth work, and I can make the SSL certs work, but I can't seem to find anyway to make them *both* work (either/or that is). Can anyone point me to a HOWTO or another thread that might discuss this? I've read the SSL howto on apache.org but I can't seem to make it work for with a <limit PUT POST DELETE> clause. What is happening is valid certificates are being ignored and Basic Auth is being requested anyway. Thanks for your help! Stripped VHost Config: SSLVerifyClient optional SSLVerifyDepth 1 SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire +StdEnvVars <Directory "blah"> AllowOverride all Order deny,allow Deny from all Satisfy any SSLRequireSSL SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 # Stripped other SSLRequire command matching certificate names for testing. # For now just let in any cert belonging to my CA. #AuthMySQL Stuff AuthBasicAuthoritative Off #table/user/password stuff here AuthMySQLAuthoritative Off AuthMySQLKeepAlive On AuthMySQLEnable On AuthType Basic AuthName "Secret Place" #GET placed here for ease of testing <limit GET PUT POST DELETE> Require valid-user </limit> </Directory> |