Apache · Configuration and operations
How do you configure authentication in Apache?
Short answer
Choose an AuthType and provider, set AuthName, and supply credentials through mod_authn_file, LDAP, database or another module. Basic authentication must run over TLS and should use strong password hashing.
Authentication establishes identity; authorization decides what that identity may do. Apache separates the two with mod_authn and mod_authz modules. AuthType Basic is common, but it sends credentials in base64, which is not encryption, so it is only acceptable over HTTPS.
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authz_user_module modules/mod_authz_user.so
<Location "/admin">
AuthType Basic
AuthName "Admin area"
AuthBasicProvider file
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Location>Provider choices
- mod_authn_file: small static user lists, suitable for a handful of operators
- mod_authn_dbd: users in a SQL database through mod_dbd
- mod_authnz_ldap: directory-backed authentication and group checks
- mod_auth_mellon or OIDC modules: SAML and OpenID Connect flows
- Session or token validation at the application or proxy layer for modern SSO
Create password entries with htpasswd -B to use bcrypt. Protect the password file with filesystem permissions and keep it outside the document root. Rotate credentials and remove stale accounts; a static file has no built-in expiry or lockout.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between authentication and authorization?
- 2Why is Basic authentication unsafe without TLS?
- 3How do you hash passwords for Apache?
- 4When would you use LDAP instead of a password file?
Say it in the interview
Authentication proves identity, and Apache implements it with an AuthType and a provider such as mod_authn_file or LDAP. I only use Basic auth over TLS, with bcrypt hashes and a password file outside the document root. For real user-facing systems I prefer an identity provider with sessions and revocation, because static basic auth has no logout or lockout.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.