Question & Answer
Question
How do you restrict certain user profiles from accessing an HTTP Apache Server?
Cause
Certain user profiles may be defined with more authority than person's user profile has. The use of these user profile may be allowed by multiple people for a particular application but was never intended to be used for general access to the IBM i.
When setting up an HTTP Apache server, user authentication may be defined. Be default, the directives added for such authentication will only validate that the user exists and that the password for the user profile is correct.
To prohibit these user profiles from having access to the server, you will need to add the following in the container where the PasswdFile, Require, AuthType and AuthName directives are found:
- RewriteCond %{REMOTE_USER} <userprofile>
RewriteRule .* - [F]
The <userprofile> value can be one to many user profiles. For example, if you were trying to restrict 1 user profile, the directives would look like
- RewriteCond %{REMOTE_USER} USERPRF01
RewriteRule .* - [F]
or multiple user profiles
- RewriteCond %{REMOTE_USER} ^USERPRF01|USERPRFB|USERPRFXYZ$
RewriteRule .* - [F]
You can also use a regular expression. For example, if you want to restrict all the user profiles that begin with USERPRF, it would look like this
- RewriteCond %{REMOTE_USER} ^USERPRF.*$
RewriteRule .* - [F]
For more information concerning regular expressions used in HTTP Apache Directives, please see http://www.ibm.com/support/knowledgecenter/ssw_ibm_i_71/rzaie/rzaieregexpnot.htm
Was this topic helpful?
Document Information
More support for:
IBM i
Software version:
Version Independent
Operating system(s):
iSeries, IBM i
Document number:
667201
Modified date:
18 December 2019
UID
nas8N1021411