=== L1 Credential Validation — support / HJ0v0IfliqJEVmi5qnfAAb1V4Gsw6JB6deESOBoVAOpgolVdVkra9kJANMiWs6PF ===
Date: 2026-09-28

--- Password analysis ---
Password: HJ0v0IfliqJEVmi5qnfAAb1V4Gsw6JB6deESOBoVAOpgolVdVkra9kJANMiWs6PF
Length: 64 chars
Charset: base64 (A-Z a-z 0-9 + /)
Base64-decode: 48 bytes of binary (non-printable) — NOT a human password.
Likely format: API key / token / secret, NOT a portal login password.

--- Login attempts (all form POST to /rih/authentication/authenticate) ---

Attempt 1: login=support (literal)
  → 302 Location: /portal/login#error
  → Set-Cookie: PHARMANUAGE_SESSION=; Max-Age=0 (cleared)

Attempt 2: login=support@pharmanuage.fr
  → 302 Location: /portal/login#error (identical)

Attempt 3: login=support@dev.pharmanuage.fr
  → 302 Location: /portal/login#error (identical)

Attempt 4: login=support@cegedim.com
  → 302 Location: /portal/login#error (identical)

Attempt 5: login=support@medexact.com
  → 302 Location: /portal/login#error (identical)

Attempt 6: login=support@cegedim.cloud
  → 302 Location: /portal/login#error (identical)

Attempt 7: login=support@pharmanuage.fr, service=kibana.dev origin
  → 302 Location: /portal/login#error (identical)

Attempt 8: Cookie-jar (GET /portal/login first, then POST with session)
  → 302 Location: /portal/login#error (identical)

--- Anti-enumeration test ---
Fake user: zzznotexist_xyzzy_12345@nowhere.com + wrong pass
  → 302 Location: /portal/login#error (IDENTICAL to real cred)
Empty login: → 302 #error (identical)
Empty password: → 302 #error (identical)

CONCLUSION: Auth endpoint has proper anti-enumeration.
ALL failure modes return identical 302→#error regardless of:
  - user exists or not
  - password correct or not
  - fields empty or not

Cannot distinguish "invalid credential" from "wrong login format".
The portal may require a specific email format not yet guessed.

--- Alternative auth methods tried ---
Basic Auth (support:pass) on /rih/, /status, / → no change (301/200/403, same as no-auth)
Bearer token (pass as Bearer) on /rih/, /rih/users, /status → no change (403/404/200)
JSON content-type POST → 400 Bad Request (form-only, JSON not accepted)

--- Other hosts tried ---
monitoring.build.pharmanuage.fr (80.94.185.54, F5 BIG-IP, preprod)
  → Same Smart RX portal, same auth backend
  → Basic Auth: 301 (same as no-auth)