http return codes

[John Trump]

I have users whose accounts get locked when using mercurial to push to a repo and they typo their password:

$ hg --debug clone http://server:8081/scm/hg/testbeds/dputb dputb2

using http://server:8081/scm/hg/testbeds/dputb

sending capabilities command

http authorization required

realm: SONIA :: SCM Manager

user: test

password:

http auth: user test, password *

http auth: user test, password *

http auth: user test, password *

http auth: user test, password *

http auth: user test, password *

http auth: user test, password *

abort: authorization failed

Using: Mercurial Distributed SCM (version 2.2.2) 

It appears as though the http return codes 401/403 is not being presented and the process continues to try and push using the incorrect password. We are using scm-server 1.28. Using the pam plugin to authenticate users via OS authentication mechanism. Would appreciate any recommendations on things to check/change to correct this issue. 

[Sebastian Sdorra]

Hi,

I can reproduce this issue and the problem seems to be that SCM-Manager returns code 401 for a wrong password, but it should return 403 instead. I've created a ticket for the problem:

 - https://bitbucket.org/sdorra/scm-manager/issue/520/basicauthenticationfilter-returns-wrong

I will try to fix this tomorrow.

Sebastian

2014/1/22 John Trump <tru...@gmail.com>

--
You received this message because you are subscribed to the Google Groups "scmmanager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to scmmanager+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[Michael Munsey]

I would expect a 401 for bad username/password, or a 403 for user exists but does not have access to the requested data.

--
Temo di perder viver tra coloro, che questo tempo chiameranno antico.

[John Trump]

Thank you. I appreciate your efforts.

--
You received this message because you are subscribed to a topic in the Google Groups "scmmanager" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/scmmanager/XSdXV9erlD8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to scmmanager+...@googlegroups.com.

[Sebastian Sdorra]

Could you please test the version attached to the issue:

- https://bitbucket.org/sdorra/scm-manager/issue/520/basicauthenticationfilter-returns-wrong

Sebastian

2014/1/23 John Trump <tru...@gmail.com>

[John Trump]

This seems to have done the trick. When I enter an incorrect password I know see the 403 error:

hg --debug clone http://server:8081/scm/hg/testbeds/dputb dputb2

using http://server:8081/scm/hg/testbeds/dputb

sending capabilities command

http authorization required

realm: SONIA :: SCM Manager

user: test

password: 

http auth: user test, password ****

abort: HTTP Error 403: Forbidden