Not protecting all the resources when using Location '/'

[keshor]

Hi All -

After configuring the mod_auth I am not getting providers login page for all the cases.

Below is my configuration

AuthType openid-connect
Require valid-user

When I tried to access jsp,gif ("/myapp/jsp/test.jsp", "/myapp//images/loading.gif") it is directly letting me to access without giving login page.
But for other resources like "/myapp/servlet/" or "/myapp" is shows the login page as expected.
Why would it not work for the 1st scenario?

I am pretty sure I am missing some basic config here.

Thanks
K

[zandbelt]

that's an Apache config question/issue indeed: most probably you have somewhere set authtype to none for images and jsps

[keshor]

Yes, for some reason there was the below configuration. I was referring to the wrong version of the config file initially where this by-pass setting was not there. Thanks.

<Location ~ ".css">
OIDCUnAuthAction pass
</Location>

<Location ~ ".js">
OIDCUnAuthAction pass
</Location>

<Location ~ ".gif">
OIDCUnAuthAction pass
</Location>

<Location ~ ".png">
OIDCUnAuthAction pass
</Location>