User Authentication

In order to control access by user authentication, you'll need to create a file containing user/password correspondences and tell our server to use that file to authenticate users.

You create the file by using the htpasswd program. To tell our server to use user authentication in a particular directory, you just create a file named .htaccess in the directory that you want to protect and put in the appropriate access control directives.

If you just want to jump in without reading the documentation, you can probably modify the following example to suit your needs. Suppose that I want to create a directory where I can put files to be accessed only by people who have a password that I've given them. Here's what I'd do:

Create the directory

I'll call my diretory `private' and put it directly under my public_html directory: mkdir ~/public_html/private chmod go+x ~/public_html/private

Create the password database

I'll add a couple of users, one for me and one for my friend, Opus:


	htpasswd -c ~/.my_passwd_file ron
	htpasswd ~/.my_passwd_file opus

In each case, I'll be prompted to for a password. The first command has a -c. That tells htpasswd that we're starting a new password file. Don't use it on subsequent commands unless you want to wipe your old password file.

Tell the server

To tell the server to use authentication, I'll create a .htaccess file in ~/public_html/private. To do this, I'll use my a text editor and I'll put the following in it: AuthUserFile /home/tapia/.my_passwd_file AuthGroupFile /dev/null AuthName "Tapia's Private Area" AuthType Basic <Limit GET> order deny,allow require valid-user </Limit> For a complete explanation, of these directives, take a look at the access configuration docs. The two important lines are the ones beginning AuthUserFile and AuthName. The AuthUserFile line tells the server to use my password file to authenticate users. The AuthName is just a string that is used when the client prompts for a password. It lets the user know what username and password she should use. If it contains spaces, it must be surrounded by double quotes.

Now, when I try to access:


		http://www.nmia.com/~tapia/private/

I'll be prompted for a password. When playing around with passwords, remember that your client probably remembers passwords so that once you give a valid password, you won't be prompted again until you restart the client.

Maintained by:

www@nmia.com