[JIRA] Commented: (EDS-45) EDS doesn't work where SP is protecting /

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/EDS-45?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14070#comment-14070 ] 

Scott Cantor commented on EDS-45:
---------------------------------

A more portable approach (this won't work on Apache 2.4) would be to just test for mod_shib.c and turn off requireSession and override require.

That won't work until 2.5 ships (I renamed the module source to the more sensible thing). At the moment, it's mod_apache.c, I suspect.

> EDS doesn't work where SP is protecting /
> -----------------------------------------
>
>                 Key: EDS-45
>                 URL: https://issues.shibboleth.net/jira/browse/EDS-45
>             Project: Embedded Discovery Service
>          Issue Type: Bug
>    Affects Versions: 1.0.2
>            Reporter: Rhys Smith
>            Assignee: Rod Widdowson
>            Priority: Minor
>
> So, if you are to set the SP to protect / (i.e. in /etc/httpd/conf.d/shib.conf you have:
> <Location />
>   AuthType shibboleth
>   ShibRequestSetting requireSession 1
>   require valid-user
> </Location>
> ...then obviously you can't get to /shibboleth-ds/ without authenticating first. Which requires you to choose an IdP to authenticate at. Which requires the DS. Which requires you to authenticate first. Which requires... You see where I'm going with this!
> If /etc/httpd/conf.d/shibboleth-ds.conf is modified to include "Satisfy Any" in its Location block then you tell Apache to effectively ignore any access control directives it has inherited, meaning people can always get to /shibboleth-ds/. So changing the file to a little something like this seems to work nicely:
> =====
> # Basic Apache configuration
> # Do NOT edit this file with your own settings,
> # or they will be overwritten during upgrades.
> <IfModule mod_alias.c>
>   <Location /shibboleth-ds>
>     Satisfy Any
>     Allow from all
>   </Location>
>   Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js
>   Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js
>   Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css
>   Alias /shibboleth-ds/index.html /etc/shibboleth-ds/index.html
> </IfModule>
> =====
> Unless someone else has a reason for this being a stupid thing to do, I would suggest this was the default config to avoid people who do want to protect / breaking the DS by accident.
> Regards,
> Rhys.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira