Protecting application in apache

There are 3 approaches:

1. placing protection in vhost config file

   <Location /secretFolder>
      AuthType Basic
      AuthName “Secret folder authentication”
      ShibRequireSession on
      require valid-user
   </Location>
   

2. enabling .htaccess to protect the folder
   • edit vhost in apache and enable access to .htaccess on affected directory declaration

     <Directory />
        AllowOverride AuthConfig, Limit, Options
        ...
     </Directory>
     

   • create .htaccess file at the folder that you'd want to protect with the following content

     AuthType Basic
     AuthName “Secret folder authentication”
     ShibRequireSession on
     require valid-user
     

3. using shibboleth.xml XML access control