Apache 2.4

[Michael R. Gettes]

Well, this is certainly good news!  It makes apache 2.4 worth really considering as long as funky modules aren't needed and hopefully mod_auth_ldap (and variants) will get updated - maybe I will take a stab at them in my copious spare time :-)

My personal belief is if we could demonstrate to people this functionality then maybe they would find shib even more attractive for use in simple cases of protecting non-app web sites.  Just my humble opinion.

/mrg

On Mar 19, 2012, at 15:23, Cantor, Scott wrote:

>> Do you recall back in 2007 when I was doing the initial COmanage work we
>> had a few go-arounds regarding how Apache handles authZ - I was wanting
>> to get Apache to do shib for authN but then LDAP group based authZ.  I have
>> not looked at any of the 2.4 stuff but I was wondering about your thoughts as
>> to whether or not this sort of thing will finally be possible with 2.4?
> 
> As far as I remember, it's possible now, that's what the AuthzShibAuthoritative command is for. Today, each authz module has to expose a flag like that so that if they don't understand some of the require options, control will be passed to a later module. If you want to combine them today, you have to select one module to be the final authority, and you have to avoid things Apache doesn't support, like AND logic between rules handled by separate modules.
> 
> At the time you asked about it, there was no flag supported. Once I understood the undocumented convention that module writers were expected to follow to get around the limitation, I added it.
> 
> With 2.4, that need goes away, and support for AND/OR containers is provided by the core. There's no single module that's considered authoritative because the logic tree is implemented by mod_authz_core. In return, they broke all older authz modules.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net