Apache 2.4

[Michael R. Gettes]

Scott,

Do you recall back in 2007 when I was doing the initial COmanage work we had a few go-arounds regarding how Apache handles authZ - I was wanting to get Apache to do shib for authN but then LDAP group based authZ.  I have not looked at any of the 2.4 stuff but I was wondering about your thoughts as to whether or not this sort of thing will finally be possible with 2.4?

/mrg

On Mar 19, 2012, at 12:15, Cantor, Scott wrote:

> Apache 2.4 is out in the wild and of course I've already gotten questions on supporting it.
> 
> I've done a preliminary examination, and I believe I have the module close to building, if untested. However, I can't do a build until I essentially recode (or eliminate) all of the authz logic in the module.
> 
> Apache 2.2 introduced what was supposed to be a new provider-based architecture for authn/authz plugins, but they did essentially a halfway job of it, which is why the 2.0 module worked almost unmodified. The 2.3 (and now 2.4) version completed this change, and it breaks any existing module that does classic require-line parsing of authz rules. This is because they've implemented AND/OR logic directly inside Apache, and they don't allow modules to just walk the require list anymore.
> 
> I need to reimplement that code to support the new features and APIs, and eliminate the ShibRequireAll command in a 2.4 build. I don't think this is unfeasible in a short amount of time.
> 
> I also need to evaluate the wisdom of continuing to directly implement "require user" and the other legacy require types, but I think the differing semantics I have for them make it impossible for me to eliminate that code. I will probably eliminate support for "require group" because that's supported better by the new pluggable features in Apache without me muddying that up.
> 
> As for the rest of their architectural shift, it's quite specific to HTTP authentication methods, and I doubt that redesigning the authentication half of the module is going to be terribly useful, if it's even possible.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net