option to 401 basic auth users to handle incorrect passwords

[stnoonan]

We use this plugin in a multi environment park and many users don't use SSO.
This change asks for password to users not in the SSO domain but don't ask again in case of mistake.
It's possible to add the two different behaviors with a new parameter for example ?

d335e08#commitcomment-4856316

[xiaods]

this patch is merged. why not close it?

[stnoonan]

There is no patch merged that fixes this. The current behavior does not prompt again when an incorrect password is provided, which is the behavior requested in the ticket.

[xiaods]

@stnoonan you mean changed from 403 to 401?

[stnoonan]

Yes, but only for basic auth. If we're properly doing negotiate, 403 is correct. If they're doing basic auth, they may have typed a password in wrong, so there should be at least one additional round of 401 responses.

[wells]

Looking forward to having this for those who don't do SPNEGO.

Will it continue asking after each failed attempt unless they give up/cancel?
What about after the first failure of basic? Is this fixing the 403 with no reattempt at auth on refresh?

Also, I found I had to specify my realm setting in order for basic to work (only tested Firefox so far).

[aperigault]

Hi!
I'm looking for update my nginx and again I see this issue open. Any news about a fix ? I use an older spnego-http-auth-nginx-module commit before d335e08 and I will be happy to use master branch :-).

[neptunao]

+1 this issue bother me too.