{"id":818,"date":"2013-03-11T16:04:24","date_gmt":"2013-03-11T20:04:24","guid":{"rendered":"http:\/\/blog.uvm.edu\/ctl-projects\/?p=388"},"modified":"2013-03-11T16:04:24","modified_gmt":"2013-03-11T20:04:24","slug":"password-protection-tool","status":"publish","type":"post","link":"https:\/\/blog.uvm.edu\/waw\/2013\/03\/11\/password-protection-tool\/","title":{"rendered":"Password Protection tool"},"content":{"rendered":"<p>Client reported tool (https:\/\/www.uvm.edu\/htpasswd) wasn&#8217;t behaving.<\/p>\n<p>&nbsp;<\/p>\n<p>Some time ago, the webteam decided to change their convention for providing friendly urls. They create a friendly alias in htdocs, and point it at a folder named website in the owners home directory. For example,<\/p>\n<p><a href=\"https:\/\/www.uvm.edu\/~ugrsrch\/\">https:\/\/www.uvm.edu\/~ugrsrch\/<\/a>\u00a0, files in \/users\/u\/g\/ugrsrch\/public_html<\/p>\n<p><a href=\"https:\/\/www.uvm.edu\/ugresearch\/\">https:\/\/www.uvm.edu\/ugresearch\/<\/a>\u00a0, files in \/users\/u\/g\/ugrsrch\/website<\/p>\n<p>(Never mind that if both folders exist, these are now two distinct websites. Holy broken bookmarks and more, Batman.)<\/p>\n<p>So, the password utility at<\/p>\n<p><a href=\"https:\/\/www.uvm.edu\/htpasswd\">https:\/\/www.uvm.edu\/htpasswd<\/a><\/p>\n<p>needed to be updated to recognize the existence and priority of a website folder. this was actually pretty easy. The tricky part is the construction of .htaccess . Given a REMOTE_USER of kapoodle, it is easy enough to generate this, to force SSL:<\/p>\n<p>SSLRequireSSL<br \/>\nErrorDocument 403\u00a0<a href=\"https:\/\/www.uvm.edu\/~kapoodle\">https:\/\/www.uvm.edu\/~kapoodle<\/a><\/p>\n<p>But now our client wants\u00a0<a href=\"http:\/\/www.uvm.edu\/MyronKapoodle\">http:\/\/www.uvm.edu\/MyronKapoodle<\/a>. How do I infer<\/p>\n<p>SSLRequireSSL<br \/>\nErrorDocument 403\u00a0<a href=\"https:\/\/www.uvm.edu\/MyronKapoodle\">https:\/\/www.uvm.edu\/MyronKapoodle<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>turns out not to be an issue:\u00a0On Mar 6, 2013, at 1:42 PM, Benjamin Coddington &lt;<a href=\"mailto:bcodding@uvm.edu\">bcodding@uvm.edu<\/a>&gt; wrote:<\/p>\n<blockquote><p>Wes, I don&#8217;t think you need to worry about forcing SSL for authentication<br \/>\nanymore. \u00a0A couple years ago we wrote an apache module that monitors all the<br \/>\nserver&#8217;s responses looking for the WWW-Authenticate: Basic header, and if<br \/>\nthe response would be sent un-encrypted the server instead hijacks the<br \/>\nresponse and turns it into a redirect to the same location over SSL.<\/p>\n<p>This nicely eliminated the possibility of sending WWW-Authenticate: Basic in<br \/>\nplain text, and I think it also means you don&#8217;t have to worry about<br \/>\nSSLRequireSSL and .htaccess-https for authentication purposes.<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>Client reported tool (https:\/\/www.uvm.edu\/htpasswd) wasn&#8217;t behaving. &nbsp; Some time ago, the webteam decided to change their convention for providing friendly urls. They create a friendly alias in htdocs, and point it at a folder named website in the owners home &hellip; <a href=\"https:\/\/blog.uvm.edu\/waw\/2013\/03\/11\/password-protection-tool\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41826],"tags":[42758],"class_list":["post-818","post","type-post","status-publish","format-standard","hentry","category-wes","tag-boffins"],"_links":{"self":[{"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/posts\/818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/comments?post=818"}],"version-history":[{"count":0,"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/posts\/818\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/media?parent=818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/categories?post=818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.uvm.edu\/waw\/wp-json\/wp\/v2\/tags?post=818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}