• "Basic Access Authentication" as defined in RFC 2617 and implemented in most serious browsers and servers.
• Microsoft IE and IIS implement "Integrated Windows Authentication" (formerly called "NTLM", and also referred to as "Windows NT Challenge/Response authentication"). The pervasiveness of IE and IIS make this approach important even if it is only viable with IE and IIS.
• Application(-server) specific implementations. These are typically specific to a particular application(-server) but likely support popular browsers in addition to IE and may be portable to different server environments.

• RFC 2617 defines "Digest Access Authentication", which is architecturally superior to Basic Authentication, and can be secure even without encryption. Unfortunately, Microsoft's implementations of Digest have traditionally been flawed. See Additional Internet Explorer/Apache Problems Surface by Timothy Dyck, for example. Private correspondence with reliable Microsoft sources suggests that these flaws will never be addressed.
• Microsoft continues to add new approaches. See Web Site Authentication for a recent discussion. However, it seems unlikely that any of these Microsoft-specific approaches will be significantly adopted for use with other browsers and servers.
• There are at least two additional Apache-specific approaches. I explored two of these before developing mod_auth++, so I will describe them in more detail in describing mod_auth++.

(Aside -- see https://technologists.com/mod_auth++/ for a directory listing of the files I cite here, https://technologists.com/mod_auth++/mod_auth.c.2.0.48 for the unmodified Apache 2.0.48 version of mod_auth.c, and https://technologists.com/mod_auth++/mod_auth.c for the mod_auth++ version of mod_auth.c. Though I have only applied the new modes to mod_auth.c, mod_auth_dbm.c would probably be a better vehicle for these modes.)

1. Traditional - traditional Basic Authentication. Use User ID "guest" and Password "guest" if you wish to test this mode.
2. Ignore - ignore the Password
3. Approve - you supply your own Password. However, the Password will not work further until an administrator grants access. (The administrator may, of course, refuse to grant access.) In this example directory, the first step is request.html and the second step is approve.html. An example "content" file that is accessible if and only if the two step process has worked and an administrator has approved access is approved.html.
4. Confirm - you supply your own Password and it is accepted without administrator intervention. (The administrator may, of course, subsequently revoke access.) In this example directory, the first step is initial.html and the second step is confirm.html. An example "content" file that is accessible if and only if the two step process has worked and an administrator has not revoked access is confirmed.html.

• Making these things understandable to the inexperienced. Even Ignore mode has caused troubles for people I've wanted to have access, just because it wasn't obvious to them how to proceed.
• Some of the things in the code are not traditional to Apache and may offend some. For Approve and Confirm modes to work, the code has to be able to write to the "Password" files. It uses flock() and tries to be careful, but I imagine it will offend some anyway.

• copy my mod_auth.c to the modules/aaa directory
• make mod_auth.la
• copy .libs/mod_auth.so to the real location, e.g., cp .libs/mod_auth.so /usr/lib/httpd/modules/mod_auth.so
• restart httpd