IBM WebSphere V5.0 Security - CGISecurity

Note: Configuration changes you have made through the Web ServerAdministration Interface added the following lines in the httpd.conf file in thesection :ConfigFile "c:/ibmhttpserver/conf/ldap.prop"AuthName LDAP RealmAuthType basicRequire valid-user4.1.2 Authorization with the Web serverBy default, the Web server configuration and access control directives arehandled by the Web server administrator by modifying the httpd.conf file. Theappropriate section of the file enforces these settings.Example 4-2 Enforcing access control management by settings in httpd.conf fileAllowOverride NoneOptions NoneThe directive AllowOverride None tells the Web Server not to look for any otheraccess control definition files within the given directory scope. In a defaulthttpd.conf configuration file shipped with IBM HTTP Server, this directive isincluded in every container.However, in many cases this is a limiting factor and may require anadministrator’s intervention in case of simple changes to the file. Second, youmight want to give to an individual user or group of people the possibility toconfigure their own area of the Web site. This is not possible with the defaulthttpd.conf settings.If there is a need to set an access control on per-directory basis, overriding thesettings in httpd.conf file, IBM HTTP Server uses .htaccess files for everydirectory over which the user wants to have such control.The use of .htaccess files adds the possibility to dynamically configure securitycomponents for static portions of the Web site. Changes done to any .htaccessfile do not require restarting the Web server or any other administrator’sintervention since the file is read every time every time a resource is fetched fromthat directory.Chapter 4. Securing Web components 43