Varnish caching apache using address based Basic Authentication

apache-2.2authenticationcachevarnish

I have an Apache web server hosting a number of sites. On some sites there is HTTP Basic Authentication. I allow some hosts access to the site effectively bypassing the HTTP Auth.

For example:

Allow from 10.10.

I am now placing a Varnish caching server in front of the web server and now all requests to the web server appear as they have come from the varnish server (192.168.1.101).

The white-listed IP addresses that used to be allowed to access the sites without HTTP authentication are now being prompted for HTTP authorization.

I cant set allow from 192.168 as this effectively allows the entire web access. So my question is. Is there any way I can get varnish to pass the client IP address to the backend server to prevent this from occurring? Or does anyone know another way around this issue? Thanks in advance.

Best Answer

Configure Varnish to send X-Real-IP and use mod_rpaf for Apache2 .
IP address will be set to X-Forwarded-For (which varnish adds automagicly)

Also disable Varnish caching content with Http Auth by adding

if (req.http.Authorization) { 
   pass;
}

in vlc_fetch, because otherwise unauthorized clients could bypass auth.

Related Solutions

Using both domain users and local users for Squid authentication

Now, I need a way to allow access to users which don't have a domain account. Can this be done?

Yes.

How?

You can use an "external" ACL helper, which allows you to roll your own mechanism. See the Squid wiki "Multiple Source" entry for more details. This bit of pseudo-code lifted straight from there:

auth_param basic program /usr/local/bin/my-auth.pl
external_acl_type myAclType %SRC %LOGIN %{Proxy-Authorization} /usr/local/bin/my-acl.pl
acl MyAcl external myAclType
http_access allow MyAcl

... where my-auth.pl is a bit of perl script that performs the actual authentication, and returns OK or ERR as the result.

Apache 2.2 – Why Isn’t Apache Basic Authentication Working?

I had a similar problem with Digest authentication on a fresh 2.4 install. Looking closely at the documentation on Apache's site, it looks like the authentication directives need to be in a <Location> tag rather than a <Directory> tag. See the documentation for the AuthBasicProvider directive.

Best Answer

Related Solutions

Using both domain users and local users for Squid authentication

Apache 2.2 – Why Isn’t Apache Basic Authentication Working?

Related Topic