Basic auth with Apache and Tomcat

This is a short "recipe" article explaining how to configure basic authentication for the following setup:

• Apache Tomcat with some application that need be partially password-protected
• Apache HTTP Server 2.4 as a proxy
• CentOS 7 Linux server

Although basic authentication can be configured within Tomcat itself, my target is to use Apache for that purpose. In addition, as passing unencrypted credentials over the web is insecure, I'm going to install SSL certificates to enable HTTPS for the part of my application. This setup can be used when a part of an internal application need be secured to make it publicly accessible using a separate firewall/proxy (out of scope of this article), that part will be password-protected and SSL-encrypted.

Steps

1. Copy certificates into /etc/ssl/certs/ivanlagunov.com
2. Create symlink:

cd /etc/httpd
sudo ln -s /etc/ssl/certs/ivanlagunov.com

3. Install Apache mod_ssl

sudo yum -y install mod_ssl

4. Create file with user credentials for basic authentication

sudo htpasswd -c /usr/local/apache/password/.htpasswd_application username

5. Modify VirtualHost

sudo vi /etc/httpd/conf.d/vhosts.conf

The following are examples of virtual hosts:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/httpd/ivanlagunov.com/Answer/ivanlagunov.com.crt
    SSLCertificateKeyFile /etc/httpd/ivanlagunov.com/Request/ivanlagunov.com.key
    SSLCertificateChainFile /etc/httpd/ivanlagunov.com/Answer/Linux/ivanlagunov.com.ca-bundle
    ServerName ivanlagunov.com

    # Password-protected part of the application is available under HTTPS
    <Location /application/protected_service>
        ProxyPass ajp://localhost:8009/application/protected_service

        AuthType Basic
        AuthName "Protected application"
        # By default, credentials are loaded from the file
        # There are smarter alternatives
        # As a default, the following directive can be omitted
        AuthBasicProvider file
        # Path to the file with user credentials
        AuthUserFile /usr/local/apache/password/.htpasswd_application
        # If Authorization header is not unset
        # Tomcat will return HTTP 401 Unauthorized
        RequestHeader unset "Authorization"
        # Require any valid user, can be limited to specific users
        Require valid-user
    </Location>
</VirtualHost>

<VirtualHost *:80>
    ServerName ivanlagunov.com

    # The whole application is available under HTTP
    ProxyPass /application ajp://localhost:8009/application
</VirtualHost>

6. Restart Apache

sudo service httpd restart

Results

As a result, the following URLs will be accessible without password:

• http://ivanlagunov.com/application
• http://ivanlagunov.com/application/protected_service

The following URL won't be accessible:

• https://ivanlagunov.com/application

The following URL will be password-protected:

• https://ivanlagunov.com/application/protected_service

Once again, only the last HTTPS URL is supposed to be made publicly accessible in this setup. HTTP URLs are supposed to be internal-only, hidden behind the firewall. That was an idea but the firewall configuration is out of scope of this article.