Optional authentication / dynamic Require

I have a directory with subdirectories which are either:
- public, which means everybody (even unauthenticated users) should be
able to view them.
- private, which means only authenticated users who are also admins
should be able to view them.

What I've tried is:

	<Directory /path/to/parent/directory/*/>
		AuthName MyApp
		PerlSetVar AuthenPassphraseRootdir /path/to/wherever
		PerlSetVar AuthzCapsRootdir /path/to/wherever
		PerlAuthenHandler Apache2::Authen::Passphrase
		PerlAuthzHandler Apache2::AuthzCaps
	
		PerlAuthzHandler MyApp::private
		Require admin-if-private
	</Directory>

where MyApp::private looks like (simplified):

	sub resource_is_private { ... }
	sub is_admin { ... }
	
	sub private{
	  my $r = shift;
	
	  for my $requirement (map { $_->{requirement} } @{$r->requires}) {
		my ($command, @args) = split ' ', $requirement;
	
		given ($command){
		  when('admin-if-private'){
			return OK if !resource_is_private || ($r->user && is_admin $r->user)
		  }
	
		}
	  }
	
	  DECLINED
	}

However, apache2 asks for authentication for access to any subdirectory
(because of the Require directive), and denies access if the user
does not provide valid credentials.

One idea I had is to drop the require, and write a PerlInitHandler that
checks if the subdirectory is private and if yes it tells apache2 to
request authentication (but I don't know how to do this).

Another is to add a dummy PerlAuthenHandler that returns OK if the
subdirectory is public, and DECLINED otherwise. But it would have to run
before the other authentication handler, and I don't know how to order
handlers (Do the handlers run in the order of the Perl*Handler
directives? If yes, is this documented somewhere or may it change in a
future release?).
-- 
Marius Gavrilescu

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBCgAGBQJSh/MaAAoJEMoENb5ewbNifzAP/A0GGxlSPCz48hSFp7Iqr36d
Qvv1HuVDWOe6KyHuimLb4zP3mtcGRySTipSa9O8JzV24P9Aq2dNr32ovj340g64c
LUQ9qHesHgSMRH97wBT22YYK2Au+qV1BjjerRhiw9YMip+Eo23vp1kR6roGW+hf9
5MRe/lOWLaqV5M5HJX3H6Cfezow4Ql38lcT92pMO2uqNLSzZpELj9R+y1dco62yG
UUtLaEDFgYGZyYK2Oxc3gj0nIFhADalPLz5qOd5R9aY+f/QqKK2i3400sBw43ytV
L1TH0rIrNDGmo47sGq5LAowZR2y4e+JN+a/UIL304I7jOJhek4BqvfsgsapL2XA5
E7EmtB/EKjYA8AG3VvBImDm7ygQi1IqSA5ACQd85V7j4AeNlrZ9nLJXDS/WinG5D
UEYnLBZLV3MggILosLygukuMFCrHItjfjezeAQyCk2L57ZQHDsovQMiSaT/lBhBv
mKur3cm0tpAjW2l4kNMBVu1Wqx2oWN+kzay9511byRannMkgxnNMKYa76J726yPX
FL7/eaTjUb5MJgwybwFH1x4c4M4/AJPGb4phBatwrvoZvj8yA4bWyc0Y4QB9JDTQ
xjTN6ZnrkuFw7QWQxvv/zuuSvLDSHpzIid/qI2L4dHO8rwNbHlout45bfWvkAomH
QcwYuFZxibnTc85uPi92
=3MtD
-----END PGP SIGNATURE-----