Return-Path: 
 <users-return-107496-apmail-httpd-users-archive=httpd.apache.org@httpd.apache.org>
X-Original-To: apmail-httpd-users-archive@www.apache.org
Delivered-To: apmail-httpd-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id C711110498
	for <apmail-httpd-users-archive@www.apache.org>;
 Thu, 19 Sep 2013 06:31:31 +0000 (UTC)
Received: (qmail 38474 invoked by uid 500); 19 Sep 2013 06:31:17 -0000
Delivered-To: apmail-httpd-users-archive@httpd.apache.org
Received: (qmail 37920 invoked by uid 500); 19 Sep 2013 06:31:09 -0000
Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
list-help: <mailto:users-help@httpd.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@httpd.apache.org>
List-Post: <mailto:users@httpd.apache.org>
List-Id: <users.httpd.apache.org>
Delivered-To: mailing list users@httpd.apache.org
Received: (qmail 37903 invoked by uid 99); 19 Sep 2013 06:31:06 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 19 Sep 2013 06:31:06 +0000
X-ASF-Spam-Status: No, hits=1.5 required=5.0
	tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: domain of icicimov@gmail.com designates
 74.125.83.49 as permitted sender)
Received: from [74.125.83.49] (HELO mail-ee0-f49.google.com) (74.125.83.49)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 19 Sep 2013 06:31:02 +0000
Received: by mail-ee0-f49.google.com with SMTP id d41so3839259eek.8
        for <users@httpd.apache.org>; Wed, 18 Sep 2013 23:30:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        bh=Q2B3kTg9lk+YVP+O5CUAyuHBDN1nuUBDZ46ZgGQGA5E=;
        b=wAK18dJRz6PSH5lYYHR0JMlbgFdi646FTF0ZAVhkxkZj0+I6qL2mxdspcfIu01HOw8
         O8N01Ks4ebVFo2jMGQIDzOyeRoOS7gNNMiRPYSdKGhB4N5I3m9I3yWI3tFkkyvcEXwvt
         66h+MuKZv1G3nUp8L3NDNZBTpAi45qTiNyPNq+PljpaoyPEany5ADSBzOxeUitji01ku
         7zAv5JstvnBFgP7tzUKQMEXLW/Gv+uD99vNT/1XdDK/fDcszR8cb1uw8MMk9wCwEf0iL
         6Ff263FLfVwCnu9phTBrlmA8daGA6OoukliS4MuqOr780tHTsECiD+b3Vcl4QxxONijv
         tPEA==
MIME-Version: 1.0
X-Received: by 10.15.63.2 with SMTP id l2mr128927eex.93.1379572241109; Wed, 18
 Sep 2013 23:30:41 -0700 (PDT)
Received: by 10.223.80.137 with HTTP; Wed, 18 Sep 2013 23:30:41 -0700 (PDT)
In-Reply-To: <523750A5.8070407@christopherschultz.net>
References: <523750A5.8070407@christopherschultz.net>
Date: Thu, 19 Sep 2013 16:30:41 +1000
Message-ID: 
 <CAAKASGy5PmmysLcnwTRZ+LgbWVT4HE7wSPjg8xJLSq_7_E6PJw@mail.gmail.com>
From: Igor Cicimov <icicimov@gmail.com>
To: users <users@httpd.apache.org>
Content-Type: multipart/alternative; boundary=001a1132ed665fb53104e6b6b12c
X-Virus-Checked: Checked by ClamAV on apache.org
Subject: Re: [users@httpd] <Limit> and Satisfy in <Location> for mod_dav

--001a1132ed665fb53104e6b6b12c
Content-Type: text/plain; charset=ISO-8859-1

Hi Chris,


On Tue, Sep 17, 2013 at 4:40 AM, Christopher Schultz <
chris@christopherschultz.net> wrote:

> All,
>
> I'm having trouble getting <Limit> and Satisfy to work within a <Location>.
>
> I'm using Apache httpd 2.2.22 on Debian Wheezy.
>
> Now, "Satisfy" is not documented to work under <Location> elements, but
> also <Limit> is not documented to work under <Location>, and seems to
> work without a problem. I was wondering if it's just an accident that
> <Limit> works under <Location>, but that Satisfy can't, or the
> documentation is inaccurate, or if I simply can't do what I want to do.
>
> I am trying to protect a part of my filesystem that is accessible via
> WebDAV. I'm using mod_dav along with mod_auth_ldap and I'd like to be
> able to do this:
>
> <Directory /path/to/dav/some/subdir>
>   <Limit HEAD GET OPTIONS PROPFIND>
>     Satisfy Any
>     Require ldap-group cn=some-read-only-group
>     Require ldap-group cn=some-read-only-other-group
>   </Limit>
>   <LimitExcept HEAD GET OPTIONS PROPFIND>
>     Satisfy Any
>     Require ldap-group cn=some-read-write-group
>   </LimitExcept>
> </Directory>
>
>
> The closest thing I'm able to get working is this:
>
> <Location "/dav/Clinical/grants">
>   <Limit HEAD GET OPTIONS PROPFIND>
>     Require ldap-group cn=some-read-only-group
>   </Limit>
>  <LimitExcept HEAD GET OPTIONS PROPFIND>
>     Require ldap-group cn=some-read-write-group
>   </LimitExcept>
> </Location>
>
> It looks like I have to use <Location> instead of <Directory> because
> <Directory> does not protect directories being handled by mod_dav. Can
> someone confirm that?
>

I have a similar setting to this so I think your assumption is correct:

<Location "/protected">
  AuthType Basic
  AuthName "Secure Area"
  AuthBasicProvider ldap
  AuthLDAPURL  "ldap://localhost:4389/ou=users,o=company?uid"
  AuthLDAPBindDN uid=admin,ou=users,o=access
  AuthLDAPBindPassword password
  <Limit GET PUT>
    Require ldap-group cn=Admin, ou=groups, o=company
  </Limit>
  <LimitExcept GET PUT>
     Order Allow,Deny
     Deny from all
  </LimitExcept>
</Location>

<Location "/protected/users">
  <Limit GET>
    Require ldap-group cn=user1, ou=groups, o=company
    Require ldap-group cn=user2, ou=groups, o=company
  </Limit>
  <Limit PUT>
    Require ldap-group cn=user2, ou=groups, o=company
    Require ldap-group cn=user3, ou=groups, o=company
  </Limit>
  <LimitExcept GET PUT>
    Order Allow,Deny
    Deny from all
  </LimitExcept>
</Location>


> Whenever I use "Satisfy Any" anywhere, it appears to apply to a
> much-wider set of files than is specified in <Limit> or <Location>.
>
> Is there a way to do complicated permissions along with WebDAV?
>
> I'd appreciate any suggestions anyone might have.
>
> While I'm at it, I'd like to know whether path-ordering in httpd.conf
> will have any bearing on how the permissions are applied. Ideally, I'd
> like to be able to set permissions on a top-level directory, then
> override those permissions on a sub-directory -- not necessarily either
> widening or narrowing the permissions... I might want to do a little of
> both.
>

Yes, you are correct. I would also protect the top directory and then open
some directories for public access using "Satisfy Any", something like this:

<Directory /www/docs>
    AuthType Basic
    AuthName Documents
    AuthBasicProvider file
    AuthUserFile /usr/local/apache/passwd/passwords
    Require valid-user
</Directory>
<Directory /www/docs/public>
    # All access controls and authentication are disabled
    # in this directory
    Satisfy Any
    Allow from all
</Directory>


>
> -chris
>
> I think there is a new stuff in 2.4, something like

AuthType None
Require all granted

to remove the protection on the subdirectory but have never tried it my
self.

Cheers,
Igor

--001a1132ed665fb53104e6b6b12c
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Chris,<br><br><div><div class=3D"gmail_extra"><br>On Tu=
e, Sep 17, 2013 at 4:40 AM, Christopher Schultz <span dir=3D"ltr">&lt;<a hr=
ef=3D"mailto:chris@christopherschultz.net" target=3D"_blank">chris@christop=
herschultz.net</a>&gt;</span> wrote:<br>
<div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margi=
n:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex=
">All,<br>
<br>
I&#39;m having trouble getting &lt;Limit&gt; and Satisfy to work within a &=
lt;Location&gt;.<br>
<br>
I&#39;m using Apache httpd 2.2.22 on Debian Wheezy.<br>
<br>
Now, &quot;Satisfy&quot; is not documented to work under &lt;Location&gt; e=
lements, but<br>
also &lt;Limit&gt; is not documented to work under &lt;Location&gt;, and se=
ems to<br>
work without a problem. I was wondering if it&#39;s just an accident that<b=
r>
&lt;Limit&gt; works under &lt;Location&gt;, but that Satisfy can&#39;t, or =
the<br>
documentation is inaccurate, or if I simply can&#39;t do what I want to do.=
<br>
<br>
I am trying to protect a part of my filesystem that is accessible via<br>
WebDAV. I&#39;m using mod_dav along with mod_auth_ldap and I&#39;d like to =
be<br>
able to do this:<br>
<br>
&lt;Directory /path/to/dav/some/subdir&gt;<br>
=A0 &lt;Limit HEAD GET OPTIONS PROPFIND&gt;<br>
=A0 =A0 Satisfy Any<br>
=A0 =A0 Require ldap-group cn=3Dsome-read-only-group<br>
=A0 =A0 Require ldap-group cn=3Dsome-read-only-other-group<br>
=A0 &lt;/Limit&gt;<br>
=A0 &lt;LimitExcept HEAD GET OPTIONS PROPFIND&gt;<br>
=A0 =A0 Satisfy Any<br>
=A0 =A0 Require ldap-group cn=3Dsome-read-write-group<br>
=A0 &lt;/LimitExcept&gt;<br>
&lt;/Directory&gt;<br>
<br>
<br>
The closest thing I&#39;m able to get working is this:<br>
<br>
&lt;Location &quot;/dav/Clinical/grants&quot;&gt;<br>
=A0 &lt;Limit HEAD GET OPTIONS PROPFIND&gt;<br>
=A0 =A0 Require ldap-group cn=3Dsome-read-only-group<br>
=A0 &lt;/Limit&gt;<br>
=A0&lt;LimitExcept HEAD GET OPTIONS PROPFIND&gt;<br>
=A0 =A0 Require ldap-group cn=3Dsome-read-write-group<br>
=A0 &lt;/LimitExcept&gt;<br>
&lt;/Location&gt;<br>
<br>
It looks like I have to use &lt;Location&gt; instead of &lt;Directory&gt; b=
ecause<br>
&lt;Directory&gt; does not protect directories being handled by mod_dav. Ca=
n<br>
someone confirm that?<br></blockquote><div><br></div><div>I have a similar =
setting to this so I think your assumption is correct:<br><br>&lt;Location =
&quot;/protected&quot;&gt;
<br>=A0 AuthType Basic
<br>=A0 AuthName &quot;Secure Area&quot;
<br>=A0 AuthBasicProvider ldap
<br>=A0 AuthLDAPURL=A0 &quot;ldap://localhost:4389/ou=3Dusers,o=3Dcompany?u=
id&quot;
<br>=A0 AuthLDAPBindDN uid=3Dadmin,ou=3Dusers,o=3Daccess<br>=A0 AuthLDAPBin=
dPassword password
<br>=A0 &lt;Limit GET PUT&gt;
<br>=A0=A0=A0 Require ldap-group cn=3DAdmin, ou=3Dgroups, o=3Dcompany
<br>=A0 &lt;/Limit&gt;
<br>=A0 &lt;LimitExcept GET PUT&gt;
<br>=A0=A0=A0=A0 Order Allow,Deny
<br>=A0=A0=A0=A0 Deny from all
<br>=A0 &lt;/LimitExcept&gt;
<br>&lt;/Location&gt;<br><br>&lt;Location &quot;/protected/users&quot;&gt;
<br>=A0 &lt;Limit GET&gt;
<br>=A0=A0=A0 Require ldap-group cn=3Duser1, ou=3Dgroups, o=3Dcompany
<br>=A0=A0=A0 Require ldap-group cn=3Duser2, ou=3Dgroups, o=3Dcompany
<br>=A0 &lt;/Limit&gt;
<br>=A0 &lt;Limit PUT&gt;
<br>=A0=A0=A0 Require ldap-group cn=3Duser2, ou=3Dgroups, o=3Dcompany
<br>=A0=A0=A0 Require ldap-group cn=3Duser3, ou=3Dgroups, o=3Dcompany
<br>=A0 &lt;/Limit&gt;
<br>=A0 &lt;LimitExcept GET PUT&gt;
<br>=A0=A0=A0 Order Allow,Deny
<br>=A0=A0=A0 Deny from all
<br>=A0 &lt;/LimitExcept&gt;
<br>&lt;/Location&gt;<br><br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">
<br>
Whenever I use &quot;Satisfy Any&quot; anywhere, it appears to apply to a<b=
r>
much-wider set of files than is specified in &lt;Limit&gt; or &lt;Location&=
gt;.<br>
<br>
Is there a way to do complicated permissions along with WebDAV?<br>
<br>
I&#39;d appreciate any suggestions anyone might have.<br>
<br>
While I&#39;m at it, I&#39;d like to know whether path-ordering in httpd.co=
nf<br>
will have any bearing on how the permissions are applied. Ideally, I&#39;d<=
br>
like to be able to set permissions on a top-level directory, then<br>
override those permissions on a sub-directory -- not necessarily either<br>
widening or narrowing the permissions... I might want to do a little of<br>
both.<br></blockquote><div><br></div><div>Yes, you are correct. I would als=
o protect the top directory and then open some directories for public acces=
s using &quot;Satisfy Any&quot;, something like this:<br><br>&lt;Directory =
/www/docs&gt;<br>
=A0=A0=A0 AuthType Basic<br>=A0=A0=A0 AuthName Documents<br>=A0=A0=A0 AuthB=
asicProvider file<br>=A0=A0=A0 AuthUserFile /usr/local/apache/passwd/passwo=
rds<br>=A0=A0=A0 Require valid-user <br>&lt;/Directory&gt;<br>&lt;Directory=
 /www/docs/public&gt;<br>=A0=A0=A0 # All access controls and authentication=
 are disabled<br>
=A0=A0=A0 # in this directory<br>=A0=A0=A0 Satisfy Any<br>=A0=A0=A0 Allow f=
rom all<br>&lt;/Directory&gt;<br>=A0<br></div><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">

<br>
-chris<br>
<br>
</blockquote></div>I think there is a new stuff in 2.4, something like<br><=
br>AuthType None<br>Require all granted<br><br></div><div class=3D"gmail_ex=
tra">to remove the protection on the subdirectory but have never tried it m=
y self.<br>
<br></div><div class=3D"gmail_extra">Cheers,<br></div><div class=3D"gmail_e=
xtra">Igor<br></div></div></div>

--001a1132ed665fb53104e6b6b12c--