OIT SysCore

A "basic" .htaccess file that restricts access to a page to any UMBC-authenticated user.

WebAuthEnabled Yes
AuthType WebAuth
require valid-user

---

However, as being a UMBC-authenticated user does NOT imply any affiliation with the university, you may wish to alter the require statement to better restrict access, such as:

require attribute ( person;affiliation="faculty" ) or ( person;affilation="staff" )

will restrict access to the protected web resource to only faculty or staff.

Currently, with the default configuration available for general use, the above "person;affiliation" attribute is the only one available.

Almost Full Documentation:

WebAuthEnabled [Yes|No]
Enable processing by the WebAuth authentication module.

WebAuthRequired [Yes|No]
This isn't used much, it requires webauth processing even if there was no
"require" statement later on.

WebAuthPassAttrs [Yes|No]
Pass all attributes available in the WebAuth token into the envioronment, prefixed with ATTR_.

require clause
The apache "require" clause can have three actions "valid-user", "user", or "attribute".
valid-user simply allows anyone through that has any sort of WebAuth
credential, and is probably not what you want to do; however, it may be useful
if you are relying on the underlying application to do the authorization.
user can be followed by a list of ticket princpals (comma separated) that may have access. For example:
require user banz,jack,fritz
Will allow those with those usernames.
attribute is the most useful, as it allows you to construct some logic to restrict access to your pages, as shown in the example above.