Shibboleth configuration in Apache

Wed Apr 25 11:32:41 BST 2012

* Badri <badri at visolve.com> [2012-04-25 07:33]:
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
>   <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
> </head>
> <body bgcolor="#ffffff" text="#000000">
> Hi Peter Schober,<br>

Please don't post HTML-only emails. Not everyone reads their email
with a(n emmbedded) webbrowser.

> Thanks for guiding on this configuration stuff. I tried the way you
> have said and also by referring this link
> <a class="moz-txt-link-freetext"
> href="https://wiki.cam.ac.uk/raven/Shibboleth_access_control_using_Apache_configuration_files">https://wiki.cam.ac.uk/raven/Shibboleth_access_control_using_Apache_configuration_files</a><br>

Never heared about it. I still don't understand the difference they
make between the very first ("Any users: Require authentication but
don't limit who can authenticate.") and the second to last ("Require
authentication only: This forces the user to authenticate, but doesn't
impose any access control.") example on that page.

If in doubt I'd stick to the official documentation. Unless you're
from Cambridge, then I'd talk to Jon Warbrick who wrote that stuff.

> When I try with "Require Shibboleth" the access is allowed, but when I
> try the same with "Require user &lt;username&gt;" I get a forbidden
> error while accessing the resource. No idea why the "Require user
> &lt;username&gt;" does not works here.<br>

Well, if REMOTE_USER has a valud of "username" this should work.
To find out if that's the case look at your webserver's logs (httpd
usually logs the REMOTE_USER in the combined access log) or check the
SP's native log (needs to be writable by the webserver -- as
documented -- and you'll need to up the log level to DEBUG, to see
anything useful).

What attribute goes into REMOTE_USER is configured in shibboleth2.xml
(look for "REMOTE_USER"). You can chose from any attribute that the SP
has mapped (attribute-map.xml) and came through the attribute policy
(only mentioned here for completeness; usually there's no reason to
touch this),
-peter