This page explains how to protect a web page so that it can only be seen by people using machines within the Unviversity network (including VPN use) and/or by (Informatics) people who have authenticated to Microsoft Entra ID.
Web authors are sometimes required to limit access to certain web content to "local" users only. This can be done either by limiting access depending on the network address of the user, or by requiring that the user proves who they are (called "authentication") and then limiting access to certain groups of users ("authorisation").
It is possible to enforce restrictions on web content by creating an
.htaccess file in the appropriate directory. Note that
this will apply to sub-directories too.
Host based access restrictions
To restrict access to machines on EdLAN (the University network). This includes use of either the University or Informatics VPN services.
# Restrict access to EdLAN Require host ed.ac.uk
User based access restrictions
To restrict access to groups of users we can use the University's
Microsoft Entra ID authentication service. This is implemented in the
Apache web server using the openid-connect module. This
type of restriction was previously done using Cosign, but this is in
the process of being retired, both in Informatics and across the
University (EASE).
In an .htaccess file the following configuration will
restrict access to all University users (see below for
Informatics-only configuration):
AuthType openid-connect Require valid-user
To restrict access to specific usernames (in this example 'uun1' and 'uun2'):
AuthType openid-connect Require user uun1 uun2
To restrict access to all Informatics users, we can use an LDAP group that is automatically populated:
AuthType openid-connect Require ldap-group cn=all,ou=Capabilities,dc=inf,dc=ed,dc=ac,dc=uk
Note that many other Informatics LDAP groups are automatically populated. Please contact us if you are interested in making use of these.
Combined host and user based access restrictions
Host and user restrictions can be combined. In this example access is permitted if the user is within the University network or, if not, they are an authenticated Informatics user:
AuthType openid-connect <RequireAny> Require host ed.ac.uk Require ldap-group cn=all,ou=Capabilities,dc=inf,dc=ed,dc=ac,dc=uk </RequireAny>
Someone accessing the content from outside ed.ac.uk will fail the Require host line, and so they will be required to have authenticated to EntraID, and be an Informatics user.
Converting from Cosign to EntraID
To convert Cosign configuration to EntraID:
Replace ...
CosignProtected On AuthType Cosign
... with ...
AuthType openid-connect
Remove any CosignRequireFactor line.
If access should be restricted to Informatics users only, replace:
Require valid-user
... with ...
Require ldap-group cn=all,ou=Capabilities,dc=inf,dc=ed,dc=ac,dc=uk
If you have any questions, please contact computing support.