We’re still running Tiger for one of our web servers, because we don’t want to bring it down for a few hours. While troubleshooting a problem, I discovered that our error logs were filling up with:

In and of itself this wasn’t a big deal, but it was obscuring the real errors I was looking for.

A quick search on the error text found a solution for 10.3, and a whole bunch of questions asking how to apply that solution to 10.4. It appears that by default Apple loads a special auth_module that checks the Apple password storage first, and then the file specified by the .htaccess file. The solution was to comment out Apple’s mod_auth and uncomment the stock mod_auth.

But mod_auth was nowhere to be found in httpd.conf on our 10.4 server, and I’d guess everyone else’s.

However, it’s a standard Apache module, and a quick “locate mod_auth” found a mod_auth.so in the right place, so I tried just adding it in to httpd.conf and commenting out the Apple-specific ones:

This worked, and a test of a password-protected directory showed that the error is gone.