If you wish to authenticate users by Passport York usernames and passwords:

In the directory you wish to protect, create a .htaccess file with the following contents:

AuthType Basic
AuthName "Name of Web Area You Are Protecting"
AuthType PYork

If you wish to restrict access to any Passport York user, add:

Require valid-user

If instead, you wish to restrict access to specific Passport York users, add for each user:

Require user <user>

For simplicity, you can also add all users on one line:

Require user <user1> <user2> ... <userN>

If you're using a web application,

https://passportyork.yorku.ca/ppylogin/ppylogout

Check file permissions on your .htaccess file and directory permissions on all directories leading up to your .htaccess file.

At a minimum, your .htaccess file must be readable by the web server, which runs as user “www”:

% chmod o+r .htaccess

CAUTION: This will enable other users on the system to also read your .htaccess file. file.

You will also need to ensure that all directories up to your .htaccess file are accessible by the web server. For example, if your .htaccess file is /eecs/home/example/www/.htaccess:

% chmod o+x /eecs/home/example
% chmod o+x /eecs/home/example/www
  

(optional) You may wish to restrict access to your page to encrypted http (https) only. This will ensure that all usernames and passwords sent to your site over the web will be encrypted. In order to do this, add the following line to the top of your .htaccess file:

SSLRequireSSL

Now, if an http user tries to access your site, they will get a “Forbidden” message.

If, instead, you would like to automatically redirect any http accesses to your page to https, add the following to your .htaccess file instead of the SSLRequireSSL line above:

RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Notes:

• A utility, mkhtaccess is available for helping your build your .htaccess file (steps 1 and 2 above). See the mkhtaccess page for details.

• Full details on Apache authentication can be found in the Apache authentication documentation.

• Please refrain from using your system password in a user-defined password file. The files must be readable by everyone on the system in order to be available to the web server.