title: Using negation in LocationMatch directive
body: <p>Our site is running on apache and is secured using client certificates.  So far there was only one certificate that would provide access to the whole site.   Now, we have a requirement to expose jira to a new group of users who should not be able to access anything else but jira. I created a separate certificate for that group and planning to distinguish them by using SSLRequire and Location/LocationMatch combination.</p>
  
  <p>So the criteria is:</p>
  
  <ol>
  <li>Users with old certificate can
  access complete site</li>
  <li>Users with new certificate can only access /jira URL pattern</li>
  </ol>
  
  <p>I tried few combination but not able to get the negation for LocationMatch work.  Any help would be appreciated.</p>
  
  <p>The httpd.conf file, looks like this:</p>
  
  <pre><code>SSLVerifyClient require
  SSLVerifyDepth 1
  SSLCACertificateFile /etc/apache2/ssl/myca.crt
  
  &lt;Location /jira&gt; 
     SSLRequire   %{SSL_CLIENT_S_DN_CN} in {"AllUsers", "JiraUsers"}
  &lt;/Location&gt; 
  
  &lt;LocationMatch /!(jira)&gt; 
     SSLRequire   %{SSL_CLIENT_S_DN_CN} eq "AllUsers"
  &lt;/LocationMatch&gt;
  </code></pre>