Unsecuring Child URI

[Peter Schober]

* ronharris <neo204011 at gmail.com> [2019-06-04 18:31]:
> I have come across a requirement in my project, where I need to secure
> parent URI, but keep child URI unsecured.
> 
> URI Eg:
> /content
> /content/login
> /content/logout
> 
> I have protected "/content" as below, and it is working fine:
> <Location /content>
>   AuthType shibboleth
>   ShibRequestSetting requireSession 1
>   require valid-user
> </Location>
> 
> But how can I keep other two out of it.

The same way you'd configure Apache httpd if something else would be
securing /content, basically:
https://httpd.apache.org/docs/2.4/en/howto/auth.html

I guess you could add a LocationMatch directive for the exceptions
combined with allowing access unconditionally (though logout wouldn't
even need to be excluded):
http://httpd.apache.org/docs/2.4/en/mod/core.html#locationmatch
https://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#require

<LocationMatch ^/content/(login|logout)>
  Require all granted
</LocationMatch>

HTH,
-peter