Increasing granularity of authorization

[MortenPr]

Hi. I have the following content structure:

/foo/
/bar/

I wish to allow userA and userB to /foo/ but only userB to /bar/

What is the recommended approach? I'm thinking of making groups, eg. for the /bar directory:

require valid-user
require group /bar

And then only put userB in group /bar (Does group imply valid-user by the way?)

I would like to extrapolate this method so I for any given directory can "require group <directory>" for increased granularity. Is this feasible or is there a better approach?

Thanks for any insight.

Morten

[Jerry Stuckle]

Morten,

With several users and a list that will change, that's probably how I would do it.  Another way, if it's only one or two users, is:

  require userA
in one directory and

  require userA userB
in another directory. 

But this also means if you need to add people you'll have to modify your httpd.conf or .htaccess file, which is what I think you're trying to get around.

require valid-user just means any valid user can access the resource - it will cause the groups to be ignored.

You can find more information on how Apache authentication works on the Apache site and in the Apache mailing lists.  Others there may also have additional recommendations.

Jerry

[MortenPr]

Thanks Jerry. You're right - I want to generate a .htaccess once, and then control all authorization/authentication via the DB.

Br,

Morten