Shibboleth SP - PATH exclude in Request Mapper

[Cantor, Scott]

On 10/29/12 4:25 PM, "Ragadeep Sriperumbudur" <ragadeep99 at hotmail.com>
wrote:
>
>I read at multiple places in Shibboleth wiki to use Apache config
>extensively and not the Request Mapper but this is our first time working
>with it and during the initial setup confusion we ended up adding it
>there.
>Once I confirm that the Apache settings are all I need, I plan to drop the
>RequestMapper entries. Thanks for pointing it Scott!

It's just very easy to end up with conflicting settings and have no idea
what's going on.

BTW, I believe there is one thing the RequestMap can do that Apache can't,
and that's "unset" AuthType. I don't think Apache allows merged
configuration to undo an AuthType command (or really any other command
other than On/Off things). Since omitting a setting means "take the parent
value", and you can't have AuthType <empty>, there's no way to unset it.
If you set AuthType to something unusual, it will error out.

OTOH, the RequestMap can do that because you can set authType there to
anything but "shibboleth" and Apache won't notice (but the SP will and not
execute).

So if you had a ton of content sitting in a protected tree that you wanted
to open up, the more efficient way would be to set authType="bogus" in the
RequestMap. But the better way is to reorg the content I suppose.

-- Scott