Tim:
> A password mismatch ought to be authorisation failure (you are
not
> authorised). An authentication failure would be some other problem
> (it can't do the authentication).
Patrick O'Callaghan:
I don't think so. Authentication is about identifying the user,
authorisation is deciding what they can do.
Not on my server. Well, it's semantics. If I don't enter the
password, or try the wrong one, it's an authentication ERROR, and I am
not authorised.
-------------------
401 error (proper authorisation is required)
Authentication error information
The resource you tried to retrieve requires you to provide username and
password credentials, but your request either didn't include them, or
didn't include them properly.
-------------------
And the logs will have something like:
[Sun Apr 30 15:49:14.261826 2023] [auth_basic:error] [pid 18610] [client
192.168.1.1:36072] AH01618: user gfgaa not found: /personal/testbox/strong/
I wouldn't call that an auth failure, it's actually doing its job.
If I configure the server incorrectly, I may get a 500 error, but that
will be an authentication failure (it can't do the job).
e.g. If I try to use MD5 when it's not possible, I will get a 500 error
-----------------------
500 Internal Server Error
Internal Server Error
The server encountered an internal error or misconfiguration and was
unable to complete your request.
------------------------
And this in the logs:
[Sun Apr 30 15:44:36.485184 2023] [authn_core:error] [pid 19426] [client
192.168.1.1:36034] AH01796: AuthType MD5 configured without corresponding module
--
uname -rsvp
Linux 3.10.0-1160.88.1.el7.x86_64 #1 SMP Tue Mar 7 15:41:52 UTC 2023 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.