Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of nickgearls@gmail.com
 designates 64.233.182.187 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=D/HCgX5B+1BTGfBJRvXnT64kJ/xH40XX/VnHrzYIuoxTISxQza/kUbxx8wedHb/hLGPFfEIFzp2vxNM29s28NdvHaZtAYKnEC5FzPgdZBpaI4uJVANVKqQPlDJ4lBfpPltj2WhZGFhuM08gPvsfrhnwTyapGj2UK+BdGRt8OdiI=
Message-ID: <46FCA9F5.3090402@gmail.com>
Date: Fri, 28 Sep 2007 09:15:01 +0200
From: Nick Gearls <nickgearls@gmail.com>
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: FakeBasicAuth changes
References: <46FA839C.2090500@gmail.com>
 <1190879881.25267.5.camel@henriknordstrom.net> <46FA81B5.3030809@gmail.com>
 <46FBCF42.2030201@apache.org> <46FBD218.80002@gmail.com>
In-Reply-To: <46FBD218.80002@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Additional info: I also tried without FakeBasicAuth, to have the 
interactive password box, and with another user 'frank' and the password 
'sinatra'.
Depending on my password file, I get the following errors:
    - frank:mlVo7KaArYZhg
      -> dialog box -> frank/sinatra
      -> user frank: authentication failure: Password Mismatch
    - frank:$apr1$9U1.....$C.5OJhZ4UxxM9SIzv4XAY0
      -> no dialog box
      -> configuration error:  couldn't check access.  No groups file?
    - frank:{SHA}7DUut/wAuxmp4mKiKKNr9eEUeG0=
      -> no dialog box
      -> configuration error:  couldn't check access.  No groups file?
So, MD5 & SHA-1 are not supported.

With FakeBasicAuth, I get exactly the same password error:
user /C=BE/ST=Belgium/...: authentication failure: Password Mismatch

It seems that the CRYPT algorithm that is used is not compatible with 
the previous versions !?!
When I try 'htpasswd.exe -nbd', it responds 'Automatically using MD5 
format'.
I use OpenSSL 0.9.8e.


Nick Gearls wrote:
> I tried both MD5 and SHA-1 passwords.
> I'm on Windows XP/2003.
> 
>>> I always get 'user /...: authentication failure for "/path/":
>>> Password Mismatch', although my password file looks correct:
>>>  /C=BE/ST=Belgium/L=Brussels/O=Approach Belgium/OU=Apache test
>>> certificate/CN=127.0.0.1:xxj31ZMTZzkVA
>>>
>>> Does 2.2.6 it use another hash algorithm by default or so ?
>>
>> 1. What is your platform?
>> 2. Have you tried with the md5 password 
>> ($apr1$nvFsZ/..$kPIYJ444oUVBALuYT2nZJ0)
>>    or the SHA password ({SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=)?