Exclude path based on querystring

[Fournier, Danny G]

> Date: Wed, 10 Apr 2013 17:45:04 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: Exclude path based on querystring
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> 	<BA63CEAE152A7742B854C678D9491383750D34BE at CIO-KRC-
> D1MBX01.osuad.osu.edu>
> 
> Content-Type: text/plain; charset="iso-8859-1"
> 
> On 4/10/13 1:40 PM, "Fournier, Danny G" <Danny.Fournier at dfo-mpo.gc.ca>
> wrote:
> 
> >Is it possible to exclude a path from Shibboleth processing using a
> >specific querystring? For instance, I?d like the following path to
not
> >be
> >processed:
> >
> ><Path name="index.php?module=API" authType="shibboleth"
> >requireSession="false" />
> 
> In Apache you should use Apache commands for that. If it's IIS, then
yes, to a
> point. Not that way.
> 
>
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap
> Quer
> y
> 
> -- Scott

Scott, thanks for the hint.

For documentation purposes, here's what I ended up using:

<Path name="path/to/protect" authType="shibboleth"
	requireSession="true">

	<Path name="file1.php" authType="shibboleth"
requireSession="false" />
	
	<Query name="module" regex="^API.*" authType="shibboleth"
		requireSession="false" />
	
</Path>

Ideally, it would have been nice to force authentication of the query to
a specific file. However, if I do this:

<Path name="index.php" authType="shibboleth" requireSession="true">
	<Query name="module" regex="^API.*" authType="shibboleth"
	requireSession="false" />
</Path>	

It doesn't seem to protect it as I can change the value of module and I
don't get prompted for authentication.

Dan