What Order Do the Authentication Handlers Run In?

Question

When a new connection arrives at a q process that requires authentication, in what order are the checks performed, and which .z handler is involved?

Solution

1. If the process was started with -u or -U (a credentials file), the supplied username and password are checked against that file first.
2. .z.pw is then called with the username and password, and gets the final say — it must return a boolean. Returning 0b rejects the connection outright, no matter what the credentials file said.
3. Only once both checks pass does .z.po run, marking the connection as fully open.

Explanation

.z.po — the handler most people reach for on "new connection" — only runs after both checks succeed. A connection that fails validation never reaches it.

-u/-U give file-based username/password checking with no q code required. .z.pw is for anything more involved — checking against LDAP, a custom user table, or extra IP-based rules — and runs after the credentials file but before the connection is considered open.

Without -u/-U or a custom .z.pw, q accepts any incoming connection with no credential check at all.