We've installed Websever Authentication on a few test sites. In each instance, the first time a person visits a page (before a login session has been established), Drupal displays an access denied error saying, "You are not authorized to access this page." By refreshing the screen or navigating to another page, the error disappears and one is logged in just fine for the rest of that session.

We are using the Apache SSPI module for authentication on a Windows server.

Any insights on what we could do to troubleshoot this problem?

Thank you!

Comments

slanger’s picture

slanger commented
Status: Active » Closed (fixed)

I found a solution to this problem. In the Drupal "system" table, each contributed module is assigned a weight, which determines the order in which the modules are fired. Like most modules, Webserver Authentication was given the default weight of "0".

Our Drupal site already had many modules installed before we added Websever Authentication. Because it wasn't assigned a negative weight, Webserver Authentication was *not* the first module to fire when a page loaded. As a result, the first time a user session was established on our site, a portion of the page ended up being rendered *before* the user was actually authenticated as a valid user. This caused a weird phenomenon where part of the page displayed correctly and the other part had "access denied" errors on it.

The solution? In the Drupal "system" table, I assigned 'webserver_auth' a weight of '-100', ensuring that it was the first contributed module to be activate. The moment I did that, the errors immediately disappeared.