Apache: Basic auth for root, host-restriction on directory

Question

I want to restrict the access to my Apache HTTPD using basic auth for all files except those in a certain directory.

The following works fine for setting up basic auth for the whole server:

<Directory /> AuthType Basic AuthName "Private" AuthUserFile /usr/local/apache/passwd/passwords </Directory> 

However, I also want to restrict the directory /foo to a single host, regardless of the basic auth:

<Directory /foo> Order Deny,Allow Deny from all Allow from my-host.com </Directory> 

Both settings work fine on their own, but I cannot get them to work in combination:

• By default (or if I use Satisfy all in the /foo clause) users need to come from the right host and have valid credentials to access /foo
• If I use Satisfy any in the /foo clause then users can have either valid credentials or come from the right host

However, I want only people from my-host.com to have access to /foo without basic auth. Connections from other hosts should not be allowed even with correct credentials. In fact, those connections shouldn't even be prompted for basic auth credentials.

What am I missing?

Answer 1

Can you try it with an empty passwd file for /foo

<Directory /foo> Order Deny,Allow Deny from all Allow from my-host.com AuthType Basic AuthName "my-host only" AuthUserFile /usr/local/apache/passwd/empty Satisfy any </Directory>