auth-reject with attributes