I'm trying to restrict per-client subdirectories of an application containing static reports using .htaccess files programatically generated with a list of users for each customer, but while I can demonstrate that the .htaccess file is being parsed (500 ISE if it contains garbage, AllowOverride is working) none of the more restrictive Require statements are overriding the Require valid-user in the higher-level Location directive.
eg. /etc/httpd/conf.d/app.conf
<VirtualHost *:80>
ServerName app
RewriteEngine on
RewriteRule ^/cgi-bin\/api\/(\w+)$ /var/www/cgi-bin/App.cgi?mode=json&request=$1 [QSA,H=cgi-script]
<Directory "/var/www/cgi-bin/">
Options ExecCGI
</Directory>
<Directory "/var/www/cgi-bin/api/reports/">
AllowOverride FileInfo AuthConfig
Options +Indexes +FollowSymLinks -ExecCGI
IndexOptions +NameWidth=*
SetHandler default-handler
LogLevel trace8
</Directory>
<Location /cgi-bin/>
AuthType Basic
AuthName "App Server"
AuthUserFile /etc/httpd/conf.d/app.passwd
require valid-user
</Location>
<Location /cgi-bin/api/>
AuthType Basic
AuthName "App API"
AuthUserFile /etc/httpd/conf.d/app-api.passwd
Require valid-user
LogLevel trace8
</Location>
</VirtualHost>
/var/www/cgi-bin/api/reports/customer1/.htaccess
Require user CUSTOMER1
I have LogLevel trace8 on for the reports directory and I see
AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
AH01626: authorization result of Require valid-user : granted,
AH01626: authorization result of <RequireAny>: granted
Response sent with status 200
nothing I put in the .htaccess file seems to be referenced, wrapping Require statements in RequireAll doesn't do anything, setting Require all denied doesn't do anything, Apache is not treating the .htaccess directives as more specific than the Location directive in the config at a (higher, lefter) part of the URI.
edited: Tried adding FileInfo with no effect. Updated the example to be more complete. Settings Location /cgi-bin/api/reports/customer1 Require user CUSTOMER1 works just fine in the config, I was just trying to avoid requiring a webserver reload every time the jobs run and rebuild the .htaccess AuthZ files as some of the jobs run every minute and I didn't want to take the effort of building a more complete tool, that can reload httpd only when there are material AuthZ changes, since in theory .htaccess should be capable of making apache check for AuthZ changes on every access without privileged reloads.