[JIRA] (SSPCPP-932) Apache ShibDisable Directive should not be accepted in <Location> Context

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on SSPCPP-932 ( https://shibboleth.atlassian.net/browse/SSPCPP-932?atlOrigin=eyJpIjoiYTcwM2Q1MTExMzY1NDE0M2E0MmEzYmQwNjgyOTkwN2QiLCJwIjoiaiJ9 )

Re: Apache ShibDisable Directive should not be accepted in <Location> Context ( https://shibboleth.atlassian.net/browse/SSPCPP-932?atlOrigin=eyJpIjoiYTcwM2Q1MTExMzY1NDE0M2E0MmEzYmQwNjgyOTkwN2QiLCJwIjoiaiJ9 )

I tested this using an htaccess approach and it worked the way the vendor seems to have assumed it did, it does NOT redirect to the IdP because the ShibDisable flag trumps the session requirement.

Location merging is tricky though and I believe it works backwards from what one might expect so it’s certainly possible it behaves oddly, but there’s no way in Apache to just disallow Location usage for a setting, they’re all or nothing.

So I would say that this works as documented and while it’s possible to produce non-working combinations, that’s really not an SP bug.

( https://shibboleth.atlassian.net/browse/SSPCPP-932#add-comment?atlOrigin=eyJpIjoiYTcwM2Q1MTExMzY1NDE0M2E0MmEzYmQwNjgyOTkwN2QiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-932#add-comment?atlOrigin=eyJpIjoiYTcwM2Q1MTExMzY1NDE0M2E0MmEzYmQwNjgyOTkwN2QiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:f610547 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211026/be65267a/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-065e7912-a1d3-4002-9fb0-28f451faba52
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211026/be65267a/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-196ee2ac-07a0-4df2-9879-1b58ffffd46f
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211026/be65267a/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-c47d6550-8adb-41bd-a5ef-b0bd4b019dc2
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211026/be65267a/attachment-0005.png>