I was thinking somehow a hook into the mod_auth code... Something like a cross between Redirect and disabling the AuthConfig overrride. I'm 99% sure I could do it with code changes, but whether it could be done cleanly and/or with an add-on module is the key. i.e. Something to cause it to send back a 302 instead of the 401.
Is there any way in the module API to detect the presence of other config directives like AuthName - module directives that are not part of this module? If so, it would probably be straightforward, trick would be to get the module to run at the right time. On the "really hackish" side, I suppose I could run two separate apache instances, one where I load mod_auth/mod_access, and the other where I load a custom module that accepts those config options, but all they do is set a flag saying that the page needs to redirect. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: [EMAIL PROTECTED] University of Missouri - Rolla Phone: (573) 341-6679 UMR Information Technology Fax: (573) 341-4216 > -----Original Message----- > From: Boyle Owen [mailto:[EMAIL PROTECTED] > Sent: Monday, July 24, 2006 9:54 AM > To: users@httpd.apache.org > Subject: RE: [EMAIL PROTECTED] How to redirect to SSL if > authentication is requested > > > -----Original Message----- > > From: Neulinger, Nathan [mailto:[EMAIL PROTECTED] > > Sent: Monday, July 24, 2006 4:32 PM > > To: users@httpd.apache.org > > Subject: [EMAIL PROTECTED] How to redirect to SSL if > > authentication is requested > > > > Is there any straightforward way to tell apache (2.0 build > > from RHEL) to > > redirect if authentication is requested? > > > > I want to prevent any use of Basic auth on the > cleartext/http side of > > the vhost. I can do that easily by disabling AuthConfig overrides on > > that vhost. However, this results in all pages breaking that > > were using > > that support. > > > > What I'd like to be able to do is cause any use of AuthInfo > > on the http > > host to immediately generate a redirect response to the same server > > name, port 443. > > I don't think you can do this - the sequence of events is not how you > imagine. > > The browser doesn't know a resource is protected until it requests it. > Then it gets back a 401. This causes the browser to pop-up a password > dialogue. Once it traps the credentials, it then sends them > in a header > with a new request. > > You'd have to make the first page HTTPS, but at that point the browser > doesn't know that Auth is required... > > Rgds, > Owen Boyle > Disclaimer: Any disclaimer attached to this message may be ignored. > > > > > Is this possible? > > > > -- Nathan > > > > ------------------------------------------------------------ > > Nathan Neulinger EMail: [EMAIL PROTECTED] > > University of Missouri - Rolla Phone: (573) 341-6679 > > UMR Information Technology Fax: (573) 341-4216 > > > > > > > --------------------------------------------------------------------- > > The official User-To-User support forum of the Apache HTTP > > Server Project. > > See <URL:http://httpd.apache.org/userslist.html> for more info. > > To unsubscribe, e-mail: [EMAIL PROTECTED] > > " from the digest: [EMAIL PROTECTED] > > For additional commands, e-mail: [EMAIL PROTECTED] > > > > > This message is for the named person's use only. It may > contain confidential, proprietary or legally privileged > information. No confidentiality or privilege is waived or > lost by any mistransmission. If you receive this message in > error, please notify the sender urgently and then immediately > delete the message and any copies of it from your system. > Please also immediately destroy any hardcopies of the > message. You must not, directly or indirectly, use, disclose, > distribute, print, or copy any part of this message if you > are not the intended recipient. The sender's company reserves > the right to monitor all e-mail communications through their > networks. Any views expressed in this message are those of > the individual sender, except where the message states > otherwise and the sender is authorised to state them to be > the views of the sender's company. > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP > Server Project. > See <URL:http://httpd.apache.org/userslist.html> for more info. > To unsubscribe, e-mail: [EMAIL PROTECTED] > " from the digest: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > > --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: [EMAIL PROTECTED] " from the digest: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
