Apache2: nested require statements within Location
I'd like to set up different LDAP authorization rules for different levels of an URL. This is the config currently used
<Location />
AuthType Basic
AuthName "Foo"
AuthBasicProvider ldap
AuthLDAPURL "..."
AuthLDAPBindDN "..."
AuthLDAPBindPassword "..."
</Location>
<Location />
Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
</Location>
<Location /path/>
Require ldap-user bar
</Location>
The problem is that /path/
inherits the rules from /
. Hence for user bar
to be able to access /path/
he must also be in the foo
group.
How can I configure the user bar
to be able to access /path/
without also having to be a member of group foo
?
EDIT: Changed ldap-group
to ldap-user
for /path/
for an accurate problem description.
I had the same issue, and by seeking around, I found the apache directive AuthMerging which handles such situation.
The documentation says that the default is AuthMerging Off
(last authorization is the only one), but the above described effect seems to imply that the value is And
(last authorization restricts the previous one). The other possibility is Or
(last authorization extends the previous one). In my case, this is this Or
value that I wanted, and it worked when adding the Auth;Merging Or
directive inside the lower Location
level.
Maybe the default value is different for Directory
and Location
sections, but I didn't find anything about that.