failed authentication does not reprompt for login id

This is a discussion on failed authentication does not reprompt for login id within the Linux Web Servers forums, part of the Web Server and Related Forums category; I'm running Apache 1.3.26 on SuSE Linux 8.1. I've got a directory on the web ...


Go Back   Usenet Forums > Web Server and Related Forums > Linux Web Servers

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 08-05-2004
Scott Crevier
 
Posts: n/a
Default failed authentication does not reprompt for login id

I'm running Apache 1.3.26 on SuSE Linux 8.1. I've got a directory on
the web server that is protected by Apache's authentication, using
mod_auth_ldap for the first time. The LDAP authentication works well
when you enter the correct user id/password.

However, if you enter an incorrect userid/password, it gives me the
401 error (as defined by ErrorDocument 401...) but it does not give me
a chance to try the login again. It just leaves me on the error page.
If I click 'Reload' in the browser, it just reloads the same error
page, and another authentication error gets written to my error_log,
but no login prompt comes up. The only way to login is to shut down
the browser and start again. This happens in all browsers.

Here is the URL: http://www.snc.edu/loginldap/

Here is the excerpt from my httpd.conf:
<Directory "/PATH/HERE/htdocs/loginldap">
Order allow,deny
allow from all
AuthType Basic
AuthLDAPDereferenceAliases never
AuthName "SNC Web Site"
AuthLDAPAuthoritative on
AuthLDAPURL ldap://LDAP_IP_ADDR_HERE:389/o=SNC
require valid-user
</Directory>

Now, it's important to note that this only happens when using LDAP. I
also have another directory that uses a simple .htpasswd for
authentication and this behaves as expected. If the login fails, the
browser reprompts me for the user id (which it should since because a
failed login is usually just due to a typo or caps lock). And if I
click Cancel and land on the 401 error page, I can click 'Refresh' and
get the login prompt again.

Here is the URL: http://www.snc.edu/login/

Here is the excerpt from my httpd.conf:
<Directory "/PATH/HERE/htdocs/login">
Order allow,deny
allow from all
AuthType Basic
AuthUserFile /PATH/HERE/htdocs/login/.htpasswd
AuthName "SNC Test Login"
require valid-user
</Directory>

The simple way to see this in action is to try both of the above URLs.
When prompted, go ahead and enter a login id and password. When your
login fails, note the difference in how it's handled, and that only
one of the two will give you the chance to try logging in again.

Also, testing has shown that this has nothing to do with my
ErrorDocument directive. I've tried turning that off altogether and
just allowing the default message to come up. Same thing. Also, it
does the same thing in both IE, Mozilla and Opera.

It's got to have something to do with the headers that Apache is
sending back to the browser upon a failed authentication.

Any ideas?
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 09:07 PM.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0