Enhanced Access Control

Purpose

HTTPd has had the ability for some time to limit access to documents by either requiring users to be from certain domains, or to know a password. However, if you combined these features, the user would have to meet all the criteria. If you wanted people in your domain to have access, but limit outside access to users who have a password, people in your domain would be inconvenienced by having to authorize themselves with a password also.

In HTTPd 1.5, access to documents can be controlled in a more flexible manner. You can require that users be from certain domains and know a password, as in the past. In addition, you can now specify that users be from a certain domain, or know a password. This way local users are not inconvenienced by having to authorize themselves. Furthermore, you can use both methods in a particular document tree, using the AND behavior in some directories, and the OR behavior in others.

Syntax

To enable the more flexible access control, a new directive has been added to the family of order, allow, and require directives. This new directive is dubbed satisfy, and is used inside the Limit sectioning directive. The syntax is:

Satisfy all | any

Where you specify all if you want users to meet the restrictions of both allow and require directives, and you specify any if you only require that users meet one of the specified allow or require directives.

File

  • access.conf
  • .htaccess files

    Default

    If you do not use the Satisfy directive, the default is the AND behavior, i.e., users must satisfy an allow directive AND a require directive if both are present.

    Examples

    < Limit GET>

    order deny,allow

    deny from all

    allow from .ncsa.uiuc.edu

    require user john stan lupe

    satisfy any

    < /Limit>

    In the above example, anyone from domain ncsa.uiuc.edu can gain access to documents in the particular directory. In addition, users john, stan, and lupe can gain access, if they know their pre-arranged password.

    Refer to the documentation on the Limit directive for further information on the preceding example.

    NCSA HTTPd Development Team / httpd@ncsa.uiuc.edu / Last Modified 7-20-95