apache2 - Apache 2.4 -- how to close entire site except one subdirectory? -

we using new authentication , authorization framework offered apache-2.4 , need close entire site (location /) unauthorized access except 1 subdirectory (location /foo), there authorizing cookie can obtained. seem, authmerging directive use, things not work:

    <location />             authtype                form             authformprovider        foo             session                 on             sessioncookiename       ti2f             include                 conf/sessionpw.conf             authname                ti             <requireall>                     require         foo ipaddress                     require         foo expiration             </requireall>             errordocument           401     /foo/     </location>      <location /foo>             authmerging or             require  granted             directoryindex index.php     </location> 

unfortunately, access /foo remains blocked -- 401 unauthorized. loglevel cranked can see following messages logged mod_authz_core:

authorization result of require granted: granted authorization result of <requireany>: granted authorization result of authmerging any: granted authorization result of require granted: granted authorization result of <requireany>: granted authorization result of authmerging any: granted authorization result of require foo ipaddress: denied (no authenticated user yet) authorization result of require foo expiration: denied (no authenticated user yet) authorization result of <requireall>: denied (no authenticated user yet) authorization result of <requireany>: denied (no authenticated user yet) 

with authmerging set "or" sublocation /foo, why apache examining parent location's require-directives @ after "require granted" grants?

use locationmatch instead:

<locationmatch "!^/foo">    # lock down except /foo </locationmatch>