{"comment":{"url":"https://api.github.com/repos/jgroffen/mod_auth_gssapi/comments/15346919","html_url":"https://github.com/jgroffen/mod_auth_gssapi/commit/3570aa86f250d3c8ee6f9602bdfd7c93437688ef#commitcomment-15346919","id":15346919,"user":{"login":"frenche","id":7945916,"avatar_url":"https://avatars.githubusercontent.com/u/7945916?v=3","gravatar_id":"","url":"https://api.github.com/users/frenche","html_url":"https://github.com/frenche","followers_url":"https://api.github.com/users/frenche/followers","following_url":"https://api.github.com/users/frenche/following{/other_user}","gists_url":"https://api.github.com/users/frenche/gists{/gist_id}","starred_url":"https://api.github.com/users/frenche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frenche/subscriptions","organizations_url":"https://api.github.com/users/frenche/orgs","repos_url":"https://api.github.com/users/frenche/repos","events_url":"https://api.github.com/users/frenche/events{/privacy}","received_events_url":"https://api.github.com/users/frenche/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":"","commit_id":"3570aa86f250d3c8ee6f9602bdfd7c93437688ef","created_at":"2016-01-08T19:26:30Z","updated_at":"2016-01-08T19:26:30Z","body":"On Jan 8, 2016 11:20 AM, \"Simo Sorce\" <notifications@github.com> wrote:\n>\n> @frenche do you have any opinion on this ?\n>\n\nI'll try to have another look tomorrow as my Internet connection is\nunstable (traveling in the US).\nBut I got a few comments.\n\nIt doesn't seem the problem is related to SPNEGO negotiations as for that\nit would suffice to disable connection-bound or set only KRB5 mechanism.\nSo I guess the issue is generic, you don't want the browser to prompt if\nauthentication has failed (maybe u want to present a form-base auth\ninstead).\nIn other words, you don't want to re-auth if auth failed (any www-auth\nheader will cause browser to prompt for creds).\n\nI think it would be nice to have such a feature but I suspect that RFC wise\nu must set a WWW-Authenticate header when replying with 401 code (I'll have\nto check though).\n\nSo maybe we can return 403 instead, as if we say you are nobody if you have\nfailed auth.\nThis is somewhat similar to AuthzSendForbiddenOnFailure (code wise is\nsimple, if auth failed set ret=403).\n"}}