mod_authz_basic和CloudFront (was: mod_authz basic Directory与带有vhost的位置)

Question

我在使用Apache basic身份验证时遇到了问题。我有一个EC2服务器坐在AWS弹性负载均衡器和CloudFront后面。我在机器上运行了几个域。我使用Apache基本身份验证来访问某些区域，但它们都使用相同的htpassd和htgroup文件。它对一个域很好，限制了对一个完整子域的访问，但对于另一个域，它不适用于限制对某个位置的访问(或者，它工作得太好了--我无法获得访问)。

环境:Apache2.4.43 OpenSSL 1.0.2k-fips SVN1.14.0 PHP7.4.5

故障模式是在con.d/subversion.conf中定义的Apache location：

   <Location /repos>
   DAV svn
   SVNParentPath /var/svn/
   SVNListParentPath On
   LogLevel debug
  Options All
  AllowOverride All Options

  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /mnt/data/etc/htpasswd
  AuthGroupFile /mnt/data/etc/htgroups
  Require group subversion

错误文件显示

[Mon Aug 17 00:04:47.658169 2020] [authz_core:debug] [pid 30612] mod_authz_core.c(818): [client 10.0.200.51:11378] AH01626: authorization result of Require group subversion: denied (no authenticated user yet)
[Mon Aug 17 00:04:47.658511 2020] [authz_core:debug] [pid 30612] mod_authz_core.c(818): [client 10.0.200.51:11378] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[Mon Aug 17 00:04:54.816887 2020] [authz_core:debug] [pid 30548] mod_authz_core.c(818): [client 10.0.200.51:11382] AH01626: authorization result of Require group subversion: denied (no authenticated user yet)
[Mon Aug 17 00:04:54.817233 2020] [authz_core:debug] [pid 30548] mod_authz_core.c(818): [client 10.0.200.51:11382] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)

在用于www.myhost.com的config /vhost.conf文件中，我试图使用上面的SVN配置到达www.myhost.com/repos，我还拥有

    <Directory />
            Options All
            #Allow from All
            #Order Allow,Deny
            Require all granted
            AllowOverride All Options
            ...

在记忆(并确认)之前，我花了很长时间在不同的EC2主机和Apache实例上运行不同的场景。这在vhost.conf中运行得很好：

    ServerName dev.anotherdomain.com
    <Directory />
            Options All
            #Allow from All
            #Order Allow,Deny
            AllowOverride All Options

            # AuthType Digest
            AuthType Basic
            AuthName "DevAndTest"
            AuthUserFile /mnt/data/etc/htpasswd
            AuthGroupFile /mnt/data/etc/htgroups
            Require group adifferentgroup

这似乎很好，这让我有点迷惑不解：

Answer 1

事实证明，问题是我需要在Cloudfront发行版中白名单Authorization头。原问题中的子域案例之所以有效，是因为它没有坐在Cloudfront后面。