# Implement basic authentication

**URL:** <https://discourse.haproxy.org/t/implement-basic-authentication/1267>\
**Category:** Help!\
**Created:** [May 26, 2017, 1:57pm UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267 "2017-05-26T13:57:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [May 26, 2017, 1:57pm UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/1 "2017-05-26T13:57:28Z")

</div>

Hi Team,

Lets suppose I’ve configured a my website with domain name “[abc.zahid.com](http://abc.zahid.com)” configured in nginx. I also use subdomains like “[static1.abc.zahid.com](http://static1.abc.zahid.com)”, “[static2.abc.zahid.com](http://static2.abc.zahid.com)”, “[static3.abc.zahid.com](http://static3.abc.zahid.com)” which are configured in same vhost as “[abc.zahid.com](http://abc.zahid.com)”

Now I want a simple authentication on my haproxy where anybody who visits “[abc.zahid.com](http://abc.zahid.com)” should be prompted (ONLY once) from a username and password. once the desired password is entered it should allow all sub domains as well.

I’ve done this on my setup on haproxy, however, it is prompting for authorization on every request plz help.

Following is my haproxy config:

userlist UsersFor\_kennel  
user username insecure-password password

frontend http-mpweb  
bind 192.168.1.10:80  
reqadd X-Forwarded-Proto:\ http  
mode http  
option http-server-close

```
    acl host_zahid hdr(host) -i abc.zahid.com
    use_backend static-backend if host_zahid

    acl host_zahid hdr(host) -i static1.abc.zahid.com
    use_backend static-backend if host_zahid

    acl host_zahid hdr(host) -i static2.abc.zahid.com
    use_backend static-backend if host_zahid

    acl host_zahid hdr(host) -i static3.abc.zahid.com
    use_backend static-backend if host_zahid

```

backend static-backend

acl AuthOkay\_kennel http\_auth(UsersFor\_kennel)  
http-request auth realm kennel if !AuthOkay\_kennel

```
    balance roundrobin
    option http-server-close
    option forwardfor
    cookie mpstatic insert indirect nocache
    option httpchk HEAD /LoadBalancer_HealthCheck.php HTTP/1.0
    server web 192.168.1.20:80 cookie mpstatic1 check

```

Kindly let me know if any issue with above config.

Best Regards,  
Zahid

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 26, 2017, 6:28pm UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/2 "2017-05-26T18:28:41Z")

</div>

> [@zahid.k11](#):
>
> Now I want a simple authentication on my haproxy where anybody who visits “[abc.zahid.com](http://abc.zahid.com)” should be prompted (ONLY once) from a username and password. once the desired password is entered it should allow all sub domains as well.

That’s not how HTTP authentication works. Each request has to be authenticated. If it isn’t, haproxy will ask for it via a “401 Unauthorized” response.

Also see:

> **[Basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication)**
>
> In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request. In basic HTTP authentication, a request contains a header field in the form of Authorization: Basic \<credentials\>, where credentials is the Base64 encoding of ID and password joined by a single colon :.
> It was originally implemented by Ari Luotonen at CERN in 1993 and defined in the HTTP 1.0 specification in 1996.
> It...

---

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [May 27, 2017, 11:16pm UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/3 "2017-05-27T23:16:54Z")

</div>

Hi,

Could you please correct me with my config to only ask for authentication once and then allow me withou redundant 401.

Thanks for your kind help in advance  
Best regards,  
Zahid

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 29, 2017, 7:41am UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/4 "2017-05-29T07:41:53Z")

</div>

What I am saying is that what you are asking is not possible with HTTP Basic authentication.

Also see:

> <https://serverfault.com/questions/62868/apache-htaccess-trick-to-authenticate-only-once-for-all-subdomains>

  

> <https://stackoverflow.com/questions/339244/using-apaches-mod-auth-across-multiple-sub-domains-for-single-sign-on>

---

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [June 2, 2017, 6:41am UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/5 "2017-06-02T06:41:00Z")

</div>

Hi Lukastribus,

Ohh!! Is there a workaround.

I’ve done a lot of research but not able to find anything concrete. It keeps on asking me the haproxy basic authentication credentials. Please help!!

The following is my architecture

haproxy --\> Nginx ([abc.zahid.com](http://abc.zahid.com), static[123].abc.zahid.com) --\> tomcat

Best Regards,  
Zahid

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 2, 2017, 7:14pm UTC](https://discourse.haproxy.org/t/implement-basic-authentication/1267/6 "2017-06-02T19:14:33Z")

</div>

I will repeat myself for the third time now, hoping you understand:

This is not possible with HTTP Basic Auth, there is _no_ workaround. It would be possible with Digest Auth, but haproxy doesn’t support it.