Authentication Question (SSL + Basic)

Authentication Question (SSL + Basic)

am 25.06.2007 17:51:39 von Aaron

I'm setting up a RESTful web service and want GET to be open to all
with only PUT, POST, and DELETE restricted to registered users.
Ideally I would like to both be able to ask for a username/password
for these resources using Basic Auth and be able to use SSL
certificates for those users that want them. I'm using Apache 2.2.
The problem is I can make the Basic Auth work, and I can make the SSL
certs work, but I can't seem to find anyway to make them *both* work
(either/or that is). Can anyone point me to a HOWTO or another thread
that might discuss this? I've read the SSL howto on apache.org but I
can't seem to make it work for with a clause.
What is happening is valid certificates are being ignored and Basic
Auth is being requested anyway. Thanks for your help!

Stripped VHost Config:

SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire +StdEnvVars

AllowOverride all
Order deny,allow
Deny from all
Satisfy any

SSLRequireSSL
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
# Stripped other SSLRequire command matching certificate names
for testing.
# For now just let in any cert belonging to my CA.

#AuthMySQL Stuff
AuthBasicAuthoritative Off
#table/user/password stuff here
AuthMySQLAuthoritative Off
AuthMySQLKeepAlive On
AuthMySQLEnable On

AuthType Basic
AuthName "Secret Place"

#GET placed here for ease of testing

Require valid-user