ansaurus

Question

Apache2 Reverse Proxy to an end-point that requires BasicAuth but want to hide this from user

Answer 1

+4 A:

Add or overwrite the Authorization header before passing any request on to the endpoint. The authorization header can be hard coded, it's just a base-64 encoding of the string "username:password" (without the quotes.)

Enable the mod_headers module if not already done.

RequestHeader set Authorization "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="

To perform this conditionally, enable the mod_setenvif, e.g. still ask for the master password in the case of local requests:

SetEnvIf Remote_Addr "127\.0\.0\.1" localrequest
RequestHeader set Authorization "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" env=!localrequest

EXAMPLE

# ALL remote users ALWAYS authenticate against reverse proxy's
#  /www/conf/passwords database
#
<Directory /var/web/pages/secure>
  AuthBasicProvider /www/conf/passwords
  AuthType Basic
  AuthName "Protected Area"
  Require valid-user
</Directory>

# reverse proxy authenticates against master server as:
#  Aladdin:open sesame (Base64 encoded)
#
RequestHeader set Authorization "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="

Cheers, V.

vladr 2009-02-20 21:14:42

This looks promising but I don't want to ask for the MASTER password if it's non-local requests, i want apache to maintain a basic Auth passwd list and allow users to Auth with one of several different passwords which the endpoint will never see. This doesn't do that afaik right?

bjeanes 2009-02-22 22:42:54

Just use the first (unconditional, i.e. without SetEnvIf and 'localrequest') variant, i.e. 'RequestHeader set Authorization "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="'. The reverse proxy will always authenticate with the master password, and users will always use the other passwords to connect to the RP.

vladr 2009-02-23 00:00:35

I tried both your original suggestion using SetEnvIf and trying to get BasicAuth working and had no success either way. I can successfully disable the password thru the proxy altogether, but not conditionally based on the type of request.

bjeanes 2009-02-23 07:06:41

Not sure I understand what was successful and what was not successful. Did the "EXAMPLE" work at all, in the sense that was it able to successfully authenticate against the backend with the master password? What did not work?

vladr 2009-02-23 07:19:01

The RequestHeader part worked a charm, but the full Example has a few problems: Directory doesn't make sense here, AuthBasicProvider doesn't so what I think it does, and if it did this would always require a PW. Need to allow users to access proxy if they are on 192.168.1.* OR have a valid PW

bjeanes 2009-02-24 00:26:02

Screw it I will put the second part into another question. You've answered the core part which was how to send Auth details to the end point behind the proxy.

bjeanes 2009-02-24 00:28:34

ansaurus

tags:

views:

answers:

Apache2 Reverse Proxy to an end-point that requires BasicAuth but want to hide this from user

related questions