mod_authz_core provides a high-level interface to authorization that is much easier to use than using into the relevant hooks directly. The first argument to the Require directive gives the name of the responsible authorization provider. For any Require line, mod_authz_core will call the authorization provider of the given name, passing the rest of the line as parameters. The provider will then check authorization and pass the result as return value.

The authz provider is normally called before authentication. If it needs to know the authenticated user name (or if the user will be authenticated at all), the provider must return apache2.AUTHZ_DENIED_NO_USER . This will cause authentication to proceed and the authz provider to be called a second time.

The following authz provider function takes two arguments, one ip address and one user name. It will allow access from the given ip address without authentication, or if the authenticated user matches the second argument:

authz_provider.lua

require 'apache2'
function authz_check_foo(r, ip, user)
 if r.useragent_ip == ip then
 return apache2.AUTHZ_GRANTED
 elseif r.user == nil then
 return apache2.AUTHZ_DENIED_NO_USER
 elseif r.user == user then
 return apache2.AUTHZ_GRANTED
 else
 return apache2.AUTHZ_DENIED
 end
end

The following configuration registers this function as provider foo and configures it for URL / :

LuaAuthzProvider foo authz_provider.lua authz_check_foo
<Location "/">
 Require foo 10.1.2.3 john_doe
</Location>