pam – auth_pam in nginx seems to do nothing – solved

On a Debian 12 host I just installed nginx.
Other than change the listen directives from 80 to 8000 (still have apache2 running), I have changed nothing.
I added a new file in sites-available (and enabled it) that has the following content:

server {
  listen 8000;
  listen [::]:8000;

  root /var/www/html/webdav;

  location /webdav {
    auth_pam "Restricted";
    auth_pam_service_name "nginx";
  }
}

Next, I created a file called nginx in /etc/pam.d with this content:

auth       include      common-auth
account    include      common-account

Then, I made www-data member of the group shadow:

usermod -aG shadow www-data

Restarted nginx and issued this:

curl -I http://localhost:8000/webdav/index.html

And got this back:

HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sat, 31 Aug 2024 16:41:52 GMT
Content-Type: text/html
Content-Length: 4
Last-Modified: Sat, 31 Aug 2024 15:44:37 GMT
Connection: keep-alive
ETag: "66d33a65-4"
Accept-Ranges: bytes

I would have expected an Unauthorized, but got an 200 instead.
Anyone know what I’m doing wrong, please ?