Shibbolizing Existing Application

[tadiguy]

Thanks for the response. I'm using Lighttpd 1.4.35 which is the latest
stable release.
FCGI support for SP has a note that it requires patch for Lighttpd bug
#322. The description of the bug is "The FastCGI Spec states that
authorizers can emit headers of the format Variable-name: value and those
variables will be placed into the environment of all subsequent authorized
requests as name: value. It would be great if lighttpd supported this"
Lighttpd serving only static contents after Authorizer is mentioned in the
bug #322 discussion and I've seen it reported in other forums - i.e.
putting another fcgi responder behind the authorizer or even a php script
ends up with Forbidden because the server is correctly configured to not
serve scripts as static files.

The patch apparently fixes "All fastcgi mode=authorizer fixes (Variable-
env works, proper re-dispatching, and assert failure fix when auth is
running in front of cgi)" The problem is the patch only works up to 1.4.24
which is the reason I'm trying to workaround that because I don't want to
be stuck with old version of Lighttpd.

If anyone is successfully using Lighttpd later than 1.4.24 with SP was
patching needed? Can you share Lighttpd configuration? I've tried to
manually patch 1.4.35 but haven't been successful.



On Sat, May 24, 2014 at 9:50 PM, Cantor, Scott E. [via Shibboleth] <
ml-node+s1660669n7601114h77 at n2.nabble.com> wrote:

> On 5/23/14, 9:09 PM, "tadiguy" <[hidden email]<http://user/SendEmail.jtp?type=node&node=7601114&i=0>>
> wrote:
>
> >
> >I have an existing web application that currently interfaces to lighttpd
> >via
> >fcgi responder and does authentication against a local database. I'm
> >trying
> >to shibbolize the application and delegate AuthN/AuthZ to Shib. When I
> put
> >my custom fcgi responder behind Shibauthorizer and Shibresponder I hit
> >http
> >403 forbidden as others have reported (lighttpd only wants to serve
> static
> >pages after the fcgi authorizer - I know there are patches for older
> >versions of lighty, but don't want to patch lighty and can't use any
> other
> >httpd).
>
> I assume you're running some kind of ancient version, because AFAIK,
> lighttpd was the primary target for the FCGI support in the SP and has
> worked fine for plenty of people. Sp I don't know what limitation you're
> talking ahout, but it's news to me.
>
> >Given the above constraints, what will be a good way to shibbolize my
> >application without making significant changes to my existing fcgi
> >responder? My test setup works OK if I serve static pages and I can see
> >all
> >the shib session variables when I go to
> >https://myhost/Shibboleth.sso/Session.
>
> Given your constraints stated, there is none, you need to switch servers
> or fix lighttpd.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to [hidden email]<http://user/SendEmail.jtp?type=node&node=7601114&i=1>
>
>
> ------------------------------
>  If you reply to this email, your message will be added to the discussion
> below:
>
> http://shibboleth.1660669.n2.nabble.com/Shibbolizing-Existing-Application-tp7601091p7601114.html
>  To unsubscribe from Shibbolizing Existing Application, click here<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7601091&code=dGFkaWd1eTgxMkBnbWFpbC5jb218NzYwMTA5MXwtMTYzMjg0OTUyNQ==>
> .
> NAML<http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibbolizing-Existing-Application-tp7601091p7601115.html
Sent from the Shibboleth - Developers mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140524/bf8bbcad/attachment.html