.htpasswd with CQ | Community
Skip to main content
V
Voon_Siong
Level 4
October 16, 2015
Solved

.htpasswd with CQ

  • October 16, 2015
  • 3 replies
  • 1529 views

Hi,

My Apache web server is fronting a CQ dispatcher that is rendering from a CQ Publish Instance on the server.  Everything works correctly until I try to put a .htpasswd in my Apache config to require user authentication before users can access my CQ Publish instance.  Whenever I browse to my site, I get an authentication prompt.  This behavior is expected.  I put the user credentials, as defined by my .htpasswd file and the prompt goes away.  However, I will get a second prompt with the following message

"The server http://myserver:80 requires a username and password.  The server says: Sling (Development)."

Regardless of which user credentials I use, authentication will fail and I get the first password prompt from my .htaccess file.

I can see from my Apache's error log that the second authentication attempt was against a content in my CQ Publish instance's repository.  Why would this happen?  What is missing in my configuration?  If I remove .htaccess, I get no authentication prompts.

Please advise.

Thank You.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by JustinEd3

Hi,

I suspect the problem is that the Authorization header is being passed through from Apache to CQ. The header's value, however, is not valid as far as CQ is concerned because the username/password referenced in the header does not exist. Even when you allow anonymous access in CQ, passing a bad Authorization header will trigger an authentication request.

One solution might be to configure the dispatcher not to pass the Authorization header. Another solution would be to perform authentication within CQ.

HTH,

Justin

3 replies

J
Adobe Employee
JustinEd3Adobe EmployeeAccepted solution
Adobe Employee
October 16, 2015

Hi,

I suspect the problem is that the Authorization header is being passed through from Apache to CQ. The header's value, however, is not valid as far as CQ is concerned because the username/password referenced in the header does not exist. Even when you allow anonymous access in CQ, passing a bad Authorization header will trigger an authentication request.

One solution might be to configure the dispatcher not to pass the Authorization header. Another solution would be to perform authentication within CQ.

HTH,

Justin

joerghoh
Adobe Employee
joerghohAdobe Employee
Adobe Employee
October 16, 2015

Another option would be to reconfigure the Sling Authenticator (localhost:4502/system/console/configMgr/org.apache.sling.engine.impl.auth.SlingAuthenticator) not to perform preemptive basic authentication, but just simple basic auth (option "enabled").

Jörg

V
Voon_SiongAuthor
Level 4
October 16, 2015

Thank You Justin!  You are absolutely correct.  Once we configured the virtual host configuration to unset the Authorization header (and also commented allowAuthorized), we are only getting ONE prompt from .htpasswd and no additional prompts from Sling (Development)

Terms & ConditionsAccessibility statement

Loading footer...