[JIRA] Commented: (SSPCPP-493) Default allow access to Shibboleth.sso by default in shibd.conf

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-493?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14519#comment-14519 ] 

Scott Cantor commented on SSPCPP-493:
-------------------------------------

Can you provide an example of any case in which /Shibboleth.sso is ever protected *by Shibboleth* as opposed to via some other mechanism?

The code is not designed to ever permit that kind of thing to happen, it short-circuits requests for /Shibboleth.sso (or whatever handlerURL is set to).

So I'm not inclined to believe this should be needed for that path. Of course, /shibboleth-sp is a different story, and the PHP thing is also an issue (but a PHP problem, not something I can control).

Anyway, if you have a sample you can attach, I can check it.

> Default allow access to Shibboleth.sso by default in shibd.conf
> ---------------------------------------------------------------
>
>                 Key: SSPCPP-493
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-493
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>          Components: Configuration
>    Affects Versions: 2.5.0
>            Reporter: Aaron Howell
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 2.5.1
>
>   Original Estimate: 30 minutes
>  Remaining Estimate: 30 minutes
>
> We add the below config to shibd.conf by default in all of our installations as we have been caught out a few times when using some config directives that result in /Shibboleth.sso and /shibboleth-sp locations not being accessible. Eg:
> "<Location />" - Protecting / with Shibboleth auth, results is /Shibboleth.sso also being protected by Shibboleth auth
> "Alias / index.php" - Been used by some third party applications as a way to parse virtual paths - here we use a "php_flag engine off" - but this is probably not quite right for everything as it presumes that PHP is installed
> It is easy enough to add, however thought Shibboleth installs may benefit from having this included in the config by default
> # Ensure access is not stopped by other Auth method to Shibboleth
> <Location /Shibboleth.sso>
>   Satisfy Any
>   Allow from all
>   AuthType None
>   Require all granted
>   php_flag engine off # Maybe exclude or wrap in an IfModule
> </Location>
>   <Location /shibboleth-sp>
>     Satisfy Any
>     Allow from all
>     AuthType None
>     Require all granted
>     php_flag engine off # Maybe exclude or wrap in an IfModule
>   </Location>

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira