On Sat, 2023-04-29 at 17:39 +0100, Patrick O'Callaghan wrote:
In *some" cases, usernames are added to the password file, and the password verifies correctly (using 'htppasswd -v ...'), but Apache still throws an error, e.g.:
[Sat Apr 29 17:12:10.790251 2023] [authz_core:error] [pid 17622:tid 17769] [client 82.69.61.82:40716] AH01631: user notatest: authorization failure for "/":
(NB: "authorization failure", not "authentication failure" as with a password mismatch.)
Further thoughts... That error sound backwards.
A password mismatch ought to be authorisation failure (you are not authorised). An authentication failure would be some other problem (it can't do the authentication).
Are all the failures for trying to access the same thing?
The .htpasswd file should be outside of the webserving tree. Are you sure you're only using one file, or are correctly specifying the right one?
The .htaccess files which mention which .htpasswd file to use should use the full filepath to the .htpasswd file. And mention the correct type of authentication being used (bearing in mind that only some methods are actually usable). And you have to use the same scheme when creating the passwords.
AuthType Basic AuthName "Secure space" AuthUserFile /var/www/.htpasswd Require valid-user Satisfy All
Have you looked through Apache's own docs regarding it? e.g. https://httpd.apache.org/docs/2.4/programs/htpasswd.html