I have the following config snippet in apache 2.4
<LocationMatch ^/[...]>
AuthType Basic
AuthName "[...]"
AuthBasicProvider ldap
AuthLDAPUrl "..."
Require ldap-filter ...
Require ip 127.0.0.1 ...
</LocationMatch>
and it works pertty much as expected except if a user both authenticates and comes from the allowed IP list auth data seems to be ignored, i.e. AUTH_USER is not set for CGI
Is there a way to tell Apache in which oerder to try the Require directives, i.e. to first try verifying basic auth and only consider IP addresses if that fails?
thanks