Using .htaccess to restrict access

@david55 wrote:

Thanks, Matt, the LoginHttpAuth plugin looks potentially useful.

We use CoSign <http://weblogin.org/> (sorry, embedded links don't always seem to work for me) as our local authentication type.

CoSign requires the installation of an Apache module, some Apache config directives (which I don't need to detail here), and, regarding the specific content (Files, Location, etc) that you require authentication for:

CosignProtected  On
AuthType  Cosign
Require valid-user

Requests to a protected URI are redirected to the CoSign login page, and the environment variable REMOTE_USER is set after successful login.

Would the LoginHttpAuth plugin work with CoSign as well? The description says that it works with Basic HTTP Authentication ("AuthType Basic" ). You can see from the above that the required Apache config for CoSign is similar, but I don't know how either method actually works in detail behind the scenes..

I don't mind so much that a Piwik admin might need to login twice (ie, first to CoSign, just to even access the admin area URI, and then with a Piwik login to actually login to Piwik) if I can't integrate the two, but I still have the problem that I while I want to protect the admin area, I still need to allow all public access to the OptOpt URI (ie, that needs to bypass all authentication restrictions). I think I possibly need to go back to perusing the mod_rewrite documentation again.. Image may be NSFW.
Clik here to view.

Read full topic