Re: how to do authinfo for only one group?

[gsstark@MIT.EDU (Greg Stark)]

Well, it's clear what is intended, i'm not sure how to make Gnus do this, but
your server should probably follow this, aS well as supporting the common
practice of allowing the client to authenticate immediately after the start of
the session.

    When authorization is required, the server will send a 480
    response requesting authorization from the client. The
    client must enter AUTHINFO USER followed by the username.
    Once sent, the server will cache the username and send a
    381 response requesting the password associated with that
    username. The client must enter AUTHINFO PASS followed by
    the password for the username. The server will then check
    the authentication database to see if the username/password
    combination is valid. If the combination is valid, the
    server will return a 281 response. The client should then
    retry the original command to which the server responded
    with the 480 response. The command should then be processed
    by the server normally. If the combination is not valid,
    the server will return a 502 response.

    Clients must provide authentication when requested by the server. 
    It is possible that some implementations will accept authentication
    information at the beginning of a session, but this was not the 
    original intent of the specification.  If a client attempts to
    reauthenticate, the server may return 482 response indicating
    that the new authentication data is rejected by the server.
    The 482 code will also be returned when the AUTHINFO commands
    are not entered in the correct sequence (like two AUTHINFO
    USERs in a row, or AUTHINFO PASS preceding AUTHINFO USER).

Except that this excerpt comes from an expired draft from a working group that
was dissolved.  In fact I should mention to Lars that i was deceived when i
suggested AUTHINFO GENERIC was something useful for Gnus to support.  AUTHINFO
GENERIC, as it's name implies, is intended to allow people to experiment with
other authentication schemes.  It doesn't specify any particular protocol. 
In fact	it turns out no authentication scheme could possibly be secure given
its framework.