HTTP 401 Authorization Required returned instead of 403 Forbidden
Basics
Technical
Logistics
Basics
Technical
Logistics
Description
The comment block above the "Errors" element in shibboleth2.xml says: "You can remove the access attribute to cause the module to return a standard 403 Forbidden error code if authorization fails, and then customize that condition using your web server."
However, removing the access attribute has mod_shib producing a "401 Authorization Required" error instead of the expected 403.
The comment block above the "Errors" element in shibboleth2.xml says:
"You can remove the access attribute to cause the module to return a standard 403 Forbidden error code if authorization fails, and then customize that condition using your web server."
However, removing the access attribute has mod_shib producing a "401 Authorization Required" error instead of the expected 403.