[JIRA] Created: (EDS-45) EDS doesn't work where SP is protecting /

[cqda5sqnsjhmj7g2k9i4pzgjzyw=@https://idp.cardiff.ac.uk/shibboleth (JIRA)]

EDS doesn't work where SP is protecting /
-----------------------------------------

                 Key: EDS-45
                 URL: https://issues.shibboleth.net/jira/browse/EDS-45
             Project: Embedded Discovery Service
          Issue Type: Bug
    Affects Versions: 1.0.2
            Reporter: cqda5sqnsjhmj7g2k9i4pzgjzyw=@https://idp.cardiff.ac.uk/shibboleth
            Assignee: Rod Widdowson
            Priority: Minor


So, if you are to set the SP to protect / (i.e. in /etc/httpd/conf.d/shib.conf you have:

<Location />
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

...then obviously you can't get to /shibboleth-ds/ without authenticating first. Which requires you to choose an IdP to authenticate at. Which requires the DS. Which requires you to authenticate first. Which requires... You see where I'm going with this!

If /etc/httpd/conf.d/shibboleth-ds.conf is modified to include "Satisfy Any" in its Location block then you tell Apache to effectively ignore any access control directives it has inherited, meaning people can always get to /shibboleth-ds/. So changing the file to a little something like this seems to work nicely:

=====
# Basic Apache configuration
# Do NOT edit this file with your own settings,
# or they will be overwritten during upgrades.

<IfModule mod_alias.c>
  <Location /shibboleth-ds>
    Satisfy Any
    Allow from all
  </Location>
  Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js
  Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js
  Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css
  Alias /shibboleth-ds/index.html /etc/shibboleth-ds/index.html
</IfModule>
=====

Unless someone else has a reason for this being a stupid thing to do, I would suggest this was the default config to avoid people who do want to protect / breaking the DS by accident.

Regards,
Rhys.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira