[cpp-sp COMMIT] in /branches/REL_2: apache/mod_shib.cpp configs/apache24.config.in

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jun  3 12:52:38 2013
New Revision: 3860

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3860&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-570

Modified:
    branches/REL_2/apache/mod_shib.cpp
    branches/REL_2/configs/apache24.config.in

Modified: branches/REL_2/apache/mod_shib.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/apache/mod_shib.cpp?rev=3860&r1=3859&r2=3860&view=diff
==============================================================================
--- branches/REL_2/apache/mod_shib.cpp (original)
+++ branches/REL_2/apache/mod_shib.cpp Mon Jun  3 12:52:38 2013
@@ -136,6 +136,7 @@
 struct shib_server_config
 {
     char* szScheme;
+    int bCompatValidUser;
 };
 
 // creates the per-server configuration
@@ -143,6 +144,7 @@
 {
     shib_server_config* sc=(shib_server_config*)ap_pcalloc(p,sizeof(shib_server_config));
     sc->szScheme = nullptr;
+    sc->bCompatValidUser = -1;
     return sc;
 }
 
@@ -159,6 +161,8 @@
         sc->szScheme=ap_pstrdup(p,parent->szScheme);
     else
         sc->szScheme=nullptr;
+
+    sc->bCompatValidUser = ((child->bCompatValidUser==-1) ? parent->bCompatValidUser : child->bCompatValidUser);
 
     return sc;
 }
@@ -809,7 +813,7 @@
 #else
         shib_request_config* rc = (shib_request_config*)ap_get_module_config(r->request_config, &mod_shib);
         if (!rc || !rc->sta) {
-            ap_log_rerror(APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, SH_AP_R(r), "shib_handler found no per-request structure");
+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, SH_AP_R(r), "shib_handler found no per-request structure");
             shib_post_read(r);  // ensures objects are created if post_read hook didn't run
             rc = (shib_request_config*)ap_get_module_config(r->request_config, &mod_shib);
         }
@@ -1287,8 +1291,8 @@
                 status = true;
             }
         }
-        else if (!strcmp(w,"valid-user") && session) {
-            request.log(SPRequest::SPDebug, "htaccess: accepting valid-user based on active session");
+        else if ((!strcmp(w,"valid-user") || !strcmp(w,"shib-session")) && session) {
+            request.log(SPRequest::SPDebug, "htaccess: accepting shib-session/valid-user based on active session");
             status = true;
         }
         else if (!strcmp(w,"user") && !remote_user.empty()) {
@@ -1579,7 +1583,7 @@
     return AUTHZ_GRANTED;
 }
 
-extern "C" authz_status shib_validuser_check_authz(request_rec* r, const char* require_line, const void*)
+extern "C" authz_status shib_session_check_authz(request_rec* r, const char* require_line, const void*)
 {
     pair<ShibTargetApache*,authz_status> sta = shib_base_check_authz(r);
     if (!sta.first)
@@ -1589,7 +1593,7 @@
         Session* session = sta.first->getSession(false, true, false);
         Locker slocker(session, false);
         if (session) {
-            sta.first->log(SPRequest::SPDebug, "htaccess: accepting valid-user based on active session");
+            sta.first->log(SPRequest::SPDebug, "htaccess: accepting shib-session/valid-user based on active session");
             return AUTHZ_GRANTED;
         }
     }
@@ -1597,7 +1601,30 @@
         sta.first->log(SPRequest::SPWarn, string("htaccess: unable to obtain session for access control check: ") +  e.what());
     }
 
+    sta.first->log(SPRequest::SPDebug, "htaccess: denying shib-access/valid-user rule, no active session");
     return AUTHZ_DENIED_NO_USER;
+}
+
+extern "C" authz_status shib_validuser_check_authz(request_rec* r, const char* require_line, const void*)
+{
+    // Shouldn't have actually ever hooked this, and now we're in conflict with mod_authz_user over the meaning.
+    // For now, added a command to restore "normal" semantics for valid-user so that combined deployments can
+    // use valid-user for non-Shibboleth cases and shib-session for the Shibboleth semantic.
+
+    // In future, we may want to expose the AuthType set to honor down at this level so we can differentiate
+    // based on AuthType. Unfortunately we allow overriding the AuthType to honor and we don't have access to
+    // that setting from the ServiceProvider class..
+
+    shib_server_config* sc = (shib_server_config*)ap_get_module_config(r->server->module_config, &mod_shib);
+    if (sc->bCompatValidUser != 1) {
+        return shib_session_check_authz(r, require_line, nullptr);
+    }
+
+    if (!r->user || !*r->user) {
+        return AUTHZ_DENIED_NO_USER;
+    }
+
+    return AUTHZ_GRANTED;
 }
 
 extern "C" authz_status shib_user_check_authz(request_rec* r, const char* require_line, const void*)
@@ -1722,6 +1749,14 @@
     char* base=(char*)ap_get_module_config(parms->server->module_config,&mod_shib);
     size_t offset=(size_t)parms->info;
     *((char**)(base + offset))=ap_pstrdup(parms->pool,arg);
+    return nullptr;
+}
+
+extern "C" const char* shib_set_server_flag_slot(cmd_parms* parms, void*, int arg)
+{
+    char* base=(char*)ap_get_module_config(parms->server->module_config,&mod_shib);
+    size_t offset=(size_t)parms->info;

[... 51 lines stripped ...]