[JIRA] Updated: (SSPCPP-493) Default allow access to Shibboleth.sso by default in shibd.conf

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-493?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SSPCPP-493:
--------------------------------

         Fix Version/s: 2.5.1
    Remaining Estimate: 30 minutes
     Original Estimate: 30 minutes

> Default allow access to Shibboleth.sso by default in shibd.conf
> ---------------------------------------------------------------
>
>                 Key: SSPCPP-493
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-493
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>          Components: Configuration
>    Affects Versions: 2.5.0
>            Reporter: Aaron Howell
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 2.5.1
>
>   Original Estimate: 30 minutes
>  Remaining Estimate: 30 minutes
>
> We add the below config to shibd.conf by default in all of our installations as we have been caught out a few times when using some config directives that result in /Shibboleth.sso and /shibboleth-sp locations not being accessible. Eg:
> "<Location />" - Protecting / with Shibboleth auth, results is /Shibboleth.sso also being protected by Shibboleth auth
> "Alias / index.php" - Been used by some third party applications as a way to parse virtual paths - here we use a "php_flag engine off" - but this is probably not quite right for everything as it presumes that PHP is installed
> It is easy enough to add, however thought Shibboleth installs may benefit from having this included in the config by default
> # Ensure access is not stopped by other Auth method to Shibboleth
> <Location /Shibboleth.sso>
>   Satisfy Any
>   Allow from all
>   AuthType None
>   Require all granted
>   php_flag engine off # Maybe exclude or wrap in an IfModule
> </Location>
>   <Location /shibboleth-sp>
>     Satisfy Any
>     Allow from all
>     AuthType None
>     Require all granted
>     php_flag engine off # Maybe exclude or wrap in an IfModule
>   </Location>

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira