[JIRA] Commented: (SSPCPP-502) Apache 2.4 post_read hook isn't run on subrequests, breaks module

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-502?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14481#comment-14481 ] 

Scott Cantor commented on SSPCPP-502:
-------------------------------------

The use of a heap-based ShibTargetApache object for each request is creating a deadlock. With the original code, each instance of that object would lookup and lock the Session object but then be disposed of and free the lock every time a hook function exits.

Now the object stays alive and holds the session lock during the subrequest's execution, so the recursive attempt to lock the session in the subrequest's copy of ShibTargetApache's getSession method deadlocks.

I'm not sure if I can roll back to the original per-hook copy of ShibTargetApache or not, but it's possibly the only fix.

> Apache 2.4 post_read hook isn't run on subrequests, breaks module
> -----------------------------------------------------------------
>
>                 Key: SSPCPP-502
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-502
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: Web Server Modules
>    Affects Versions: 2.5.0
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>            Priority: Critical
>             Fix For: 2.5.1
>
>   Original Estimate: 4 hours
>          Time Spent: 5 hours, 15 minutes
>  Remaining Estimate: 0 minutes
>
> The 2.4 module support relies on the post_read hook to initialize the module request_config structure and the ShibTargetApache shim object, which is then reused across all the various hooks.
> When a request for a directory URL is sent, the server internally generates a subrequest to the default index.html page, and the request_config is no longer present, but the post_read hook never runs.
> Testing suggests that check_user still runs, so we need to:
> - fix the 2.4 "base" authz hook to handle the uninitialized case less fatally
> - make sure the check_user hook can create the objects needed itself without relying on the post_read hook

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira