[JIRA] Created: (SSPCPP-493) Default allow access to Shibboleth.sso by default in shibd.conf

[Aaron Howell (JIRA)]

Default allow access to Shibboleth.sso by default in shibd.conf
---------------------------------------------------------------

                 Key: SSPCPP-493
                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-493
             Project: Shibboleth SP - C++
          Issue Type: Improvement
          Components: Configuration
    Affects Versions: 2.5.0
            Reporter: Aaron Howell
            Assignee: Scott Cantor
            Priority: Minor


We add the below config to shibd.conf by default in all of our installations as we have been caught out a few times when using some config directives that result in /Shibboleth.sso and /shibboleth-sp locations not being accessible. Eg:
"<Location />" - Protecting / with Shibboleth auth, results is /Shibboleth.sso also being protected by Shibboleth auth
"Alias / index.php" - Been used by some third party applications as a way to parse virtual paths - here we use a "php_flag engine off" - but this is probably not quite right for everything as it presumes that PHP is installed

It is easy enough to add, however thought Shibboleth installs may benefit from having this included in the config by default

# Ensure access is not stopped by other Auth method to Shibboleth
<Location /Shibboleth.sso>
  Satisfy Any
  Allow from all
  AuthType None
  Require all granted
  php_flag engine off # Maybe exclude or wrap in an IfModule
</Location>

  <Location /shibboleth-sp>
    Satisfy Any
    Allow from all
    AuthType None
    Require all granted
    php_flag engine off # Maybe exclude or wrap in an IfModule
  </Location>

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira