{"action":"created","issue":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/7","labels_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/7/comments","events_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/7/events","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/7","id":45661444,"number":7,"title":"Processing order of authentication rules","user":{"login":"JJApache","id":8735100,"avatar_url":"https://avatars.githubusercontent.com/u/8735100?v=3","gravatar_id":"","url":"https://api.github.com/users/JJApache","html_url":"https://github.com/JJApache","followers_url":"https://api.github.com/users/JJApache/followers","following_url":"https://api.github.com/users/JJApache/following{/other_user}","gists_url":"https://api.github.com/users/JJApache/gists{/gist_id}","starred_url":"https://api.github.com/users/JJApache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JJApache/subscriptions","organizations_url":"https://api.github.com/users/JJApache/orgs","repos_url":"https://api.github.com/users/JJApache/repos","events_url":"https://api.github.com/users/JJApache/events{/privacy}","received_events_url":"https://api.github.com/users/JJApache/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-10-13T16:36:06Z","updated_at":"2015-04-19T20:02:43Z","closed_at":"2015-04-19T20:02:43Z","body":"In the Apache docs it is mentioned : \r\nBy default all Require directives are handled as though contained within a <RequireAny> container directive. In other words, if any of the specified authorization methods succeed, then authorization is granted.\r\n\r\nBut it seems different for mod_auth_gssapi.\r\n\r\nFor example, in my httpd.conf file I authorize 'all' to access error pages : \r\n```\r\nAlias /error/ \"/instance/kerb/apache_2.4/error/\"\r\n<IfModule mod_negotiation.c>\r\n        <IfModule mod_include.c>\r\n                <Directory \"/appli/projects/kerb/apache_2.4/error/\">\r\n                        AllowOverride None\r\n                        Options IncludesNoExec\r\n                        AddOutputFilter Includes html\r\n                        AddHandler type-map var\r\n                        Require all granted\r\n                        LanguagePriority fr en cs de es it nl sv pt-br ro\r\n                        ForceLanguagePriority Prefer Fallback\r\n                </Directory>\r\n\r\n                ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var\r\n                ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var\r\n                ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var\r\n                ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var\r\n                ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var\r\n                ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var\r\n                ErrorDocument 410 /error/HTTP_GONE.html.var\r\n                ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var\r\n                ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var\r\n                ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var\r\n                ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var\r\n                ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var\r\n                ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var\r\n                ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var\r\n                ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var\r\n                ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var\r\n                ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var\r\n        </IfModule>\r\n</IfModule>\r\n```\r\n\r\nThen in my vhosts, I add GSSAPI authentication : \r\n```\r\n        <Location />\r\n                AuthName \"GSSAPI Single Sign On Login\"\r\n                AuthType GSSAPI\r\n                GssapiCredStore keytab:/instance/kerb/apache_2.4/conf/krb5.keytab\r\n                Require valid-user\r\n        </Location>\r\n```\r\n\r\nThen, when accessing a wrong URL, I didn't obtain my custom 'HTTP 404' error page. \r\n\r\nHere is the logs : \r\n```\r\n[Mon Oct 13 18:25:43.133200 2014] [authz_core:debug] [pid 9554] mod_authz_core.c(802): [client 10.151.27.181:52141] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.133228 2014] [authz_core:debug] [pid 9554] mod_authz_core.c(802): [client 10.151.27.181:52141] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.133239 2014] [:info] [pid 9554] [client 10.151.27.181:52141] Sessions not available, no cookies!\r\n[Mon Oct 13 18:25:43.133331 2014] [authz_core:debug] [pid 9554] mod_authz_core.c(802): [client 10.151.27.181:52141] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.133339 2014] [authz_core:debug] [pid 9554] mod_authz_core.c(802): [client 10.151.27.181:52141] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.133345 2014] [core:error] [pid 9554] [client 10.151.27.181:52141] AH00027: No authentication done but request not allowed without authentication for /error/HTTP_UNAUTHORIZED.html.var. Authentication not configured?\r\n[Mon Oct 13 18:25:43.186508 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.186534 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.186546 2014] [:info] [pid 9540] [client 10.151.27.181:52142] Sessions not available, no cookies!\r\n[Mon Oct 13 18:25:43.188821 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of Require valid-user : granted\r\n[Mon Oct 13 18:25:43.189426 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of <RequireAny>: granted\r\n[Mon Oct 13 18:25:43.189808 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.189868 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.189911 2014] [core:error] [pid 9540] [client 10.151.27.181:52142] AH00027: No authentication done but request not allowed without authentication for /content-negotiation.html/foo. Authentication not configured?\r\n[Mon Oct 13 18:25:43.189977 2014] [negotiation:error] [pid 9540] [client 10.151.27.181:52142] AH00687: Negotiation: discovered file(s) matching request: /instance/kerb/apache_2.4/htdocs/kerb/content-negotiation (None could be negotiated).\r\n[Mon Oct 13 18:25:43.190120 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.190463 2014] [authz_core:debug] [pid 9540] mod_authz_core.c(802): [client 10.151.27.181:52142] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.190521 2014] [core:error] [pid 9540] [client 10.151.27.181:52142] AH00027: No authentication done but request not allowed without authentication for /error/HTTP_NOT_FOUND.html.var. Authentication not configured?\r\n[Mon Oct 13 18:25:43.341182 2014] [authz_core:debug] [pid 9584] mod_authz_core.c(802): [client 10.151.27.181:52143] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.341210 2014] [authz_core:debug] [pid 9584] mod_authz_core.c(802): [client 10.151.27.181:52143] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.341221 2014] [:info] [pid 9584] [client 10.151.27.181:52143] Sessions not available, no cookies!\r\n[Mon Oct 13 18:25:43.341304 2014] [authz_core:debug] [pid 9584] mod_authz_core.c(802): [client 10.151.27.181:52143] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.341312 2014] [authz_core:debug] [pid 9584] mod_authz_core.c(802): [client 10.151.27.181:52143] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.341318 2014] [core:error] [pid 9584] [client 10.151.27.181:52143] AH00027: No authentication done but request not allowed without authentication for /error/HTTP_UNAUTHORIZED.html.var. Authentication not configured?\r\n[Mon Oct 13 18:25:43.367737 2014] [authz_core:debug] [pid 9565] mod_authz_core.c(802): [client 10.151.27.181:52144] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.367801 2014] [authz_core:debug] [pid 9565] mod_authz_core.c(802): [client 10.151.27.181:52144] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)\r\n[Mon Oct 13 18:25:43.367814 2014] [:info] [pid 9565] [client 10.151.27.181:52144] Sessions not available, no cookies!\r\n[Mon Oct 13 18:25:43.380333 2014] [authz_core:debug] [pid 9565] mod_authz_core.c(802): [client 10.151.27.181:52144] AH01626: authorization result of Require valid-user : granted\r\n[Mon Oct 13 18:25:43.380451 2014] [authz_core:debug] [pid 9565] mod_authz_core.c(802): [client 10.151.27.181:52144] AH01626: authorization result of <RequireAny>: granted\r\n```\r\n\r\nFor info, I don't have this behaviour with other authentication modules like mod_auth_kerb or mod_auth_basic.\r\n"},"comment":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/comments/94309316","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/7#issuecomment-94309316","issue_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/7","id":94309316,"user":{"login":"simo5","id":8332609,"avatar_url":"https://avatars.githubusercontent.com/u/8332609?v=3","gravatar_id":"","url":"https://api.github.com/users/simo5","html_url":"https://github.com/simo5","followers_url":"https://api.github.com/users/simo5/followers","following_url":"https://api.github.com/users/simo5/following{/other_user}","gists_url":"https://api.github.com/users/simo5/gists{/gist_id}","starred_url":"https://api.github.com/users/simo5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simo5/subscriptions","organizations_url":"https://api.github.com/users/simo5/orgs","repos_url":"https://api.github.com/users/simo5/repos","events_url":"https://api.github.com/users/simo5/events{/privacy}","received_events_url":"https://api.github.com/users/simo5/received_events","type":"User","site_admin":false},"created_at":"2015-04-19T20:02:43Z","updated_at":"2015-04-19T20:02:43Z","body":"Unfortunately I cannot proceed with this issue w/o more info, I am going to consider it closed for now.\r\nfeel free to re-open and add more info if the issue is still present in master."}}