Apache 2.4

[Michael R. Gettes]

FWIW - I think keeping it clean and simpler as you have described is the right approach.

/mrg

On Mar 20, 2012, at 16:52, Cantor, Scott wrote:

> Making substantial progress on this, but a couple of questions for people
> with extensive htaccess use:
> 
> I think I will clearly need to either drop or deprecate/ignore the
> ShibRequireAll and AuthzShibAuthoritative commands, as they simply don't
> work in the 2.4 authz model. They aren't even implementable.
> 
> It seems to me that in at least the ShibRequireAll case, trying to
> "ignore" an existing command in a configuration is exactly wrong. The user
> is trying to intend that the rules be ANDed together, and 2.4 won't do
> that unless you configure that using the new syntax they provide for rule
> combining. Ignoring the old option would at best lead to the wrong
> behavior.
> 
> I'm inclined to say the same for the other option. I don't like breaking
> configs, but I don't think there's a better choice here. If you want to
> move, you really can't leave existing policy alone and breaking outright
> on those commands seems like the best way to make sure the Require rules
> get fixed to do what they're supposed to.
> 
> I think something similar may end up the case for the ShibAccessControl
> option I added. With the new model, I can directly create a "require
> shib-plugin" feature and just support external plugins that way, and I
> think it's best to just force a migration from the old way to the new way
> so that Apache's boolean logic between these different approaches works
> properly.
> 
> (Note: I'm not saying SP 2.5 will break SP 2.4 config, I'm saying SP on
> Apache 2.4 won't support the same authz commands as on < Apache 2.4.)
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net