Very Computer

  1.  accessible only via https
  2.  mod_auth protected (so it will prompt for username/password)
  3.  network restricted

I can get there (almost) with this:

<Directory "/usr/local/apache/htdocs/safe_ssl_auth">
# has to be through https
    Rewri*gine        on
    RewriteCond          %{HTTPS} !=on
    RewriteRule          (.*)$ https://%{SERVER_NAME}/safe_ssl_auth/$1 [R]
# has to be from local subnet
    Order deny,allow
    Deny from all
    Allow from XXX.XXX.0.0/16
#
  Satisfy all
# has to be a valid user
   AuthType             basic
   AuthName             "safe password protected area"
   Require              valid-user
</Directory>

This works properly if a user goes in with:

  https://server/safe_ssl_auth/document.html

and it does a redirect for:

  http://server/safe_ssl_auth/document.html

Unfortunately, it asks for a username/password BEFORE it does the http->https
redirect.  The browser isn't showing the "lock" in place, so I'm assuming
that this first username/password is going unencrypted.  If I restart the
browser it asks for that pair before it puts up the certificate dialog (I'm
using a test server certificate.)  Worse, it asks for the username/password
twice, and it won't get to the encrypted one unless it is fed a correct
pair first!

I've tried putting a mod_auth protected subdirectory within the SSL space,
hoping the "outer" rule would fire first, but it doesn't.  I've also tried
putting <IfDefine HTTPS> around the auth part, but apparently that fires
once at httpd startup and isn't useful in this context.

Is there some way to force httpd to process rules in a specified order or
conditionally?  If it could be forced to do the https rewrite first it
would presumably bail out before it got to the auth pieces.

Note that the URL redirect of http to https for a given directory only
requires:

<Directory "/usr/local/apache/htdocs/ssl_dir">
    Rewri*gine        on
    RewriteCond          %{HTTPS} !=on
    RewriteRule          (.*)$ https://%{SERVER_NAME}/ssl_dir/$1 [R]
</Directory>

This works because the /usr/local/apache/htdocs/ssl_dir is stripped down to
just ssl_dir, but the HTTPS symbol is set.

Thanks,

David Mathog

Manager, sequence analysis facility, biology division, Caltech