I have an Apache2 setup with mod_userdir
and mod_authnz_external+pwauth
so that each user can access his home and can be authenticated by his local UNIX credentials.
Now I need some kind of authorization so that each user can, after being authenticated, only access his own home directory, but not those of other users.
The caveat: in my setup, a user is not necessarily the owner of his home directory, so mod_authz_owner
won't work here.
Another problem: while Apache sets the %{REMOTE_USER}
variable, this is not usable inside <If >
directives (or other directives that might help here) because the authentication is done in a very late phase during request processing.
How can I still achieve my goal here with what Apache2 has to offer? Is there e.g. the possibility to extract the user home directory name from %{REQUEST_URI}
and pass it to a
Require user ...
directive? I have not been able to find out how to do this, so any help would be much appreciated.
Thanks in advance.