Using requireSessionWith and Need Path Exclusion

[Jim Blankenship]

We have a vendor app which we want to protect with Token auth but has some
directories which must be unprotected as it breaks internal service stuff.

My problem is that I can get it to do the right thing with Normal login but
not with our Token login.

Running Shib 2.5.1 on Windows 2012.

Any ideas how to disable auth checking when using requireSessionWith ?


An example

Directory structure

/Webapp/Secure
/Webapp/Secure/Public
/Webapp/Token
/Webapp/Token/Public

Browser Tests

- /Webapp/Secure         - prompts for normal login - yea
- /Webapp/Secure/Public  - doesn't prompt for login - yea

- /Webapp/Token          - prompts for login with Token - yea
- /Webapp/Token/Public   - prompts for login with Token - boo




<RequestMap>
            <Host name="dev.xyz.edu">
                  <Path name="Webapp" authType="shibboleth"
requireSession="false">
                        <Path name="Secure" authType="shibboleth"
requireSession="true">
                              <Path name="Public" authType="shibboleth"
requireSession="false"/>
                        </Path>
                        <Path name="Token" authType="shibboleth"
requireSessionWith="Token">
                              <Path name="Public" authType="shibboleth"
requireSession="false"/>
                        </Path>
                   </Path>
            </Host>
</RequestMap>


            <SessionInitiator type="Chaining" Location="/Login"
isDefault="false" id="Token" forceAuthn="true"
                    relayState="cookie" 
entityID="urn:mace:incommon:xyz.edu">
                <SessionInitiator type="SAML2" acsIndex="1"
                     
authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken" 
                      template="bindingTemplate.html"/>
            </SessionInitiator>

Thanks

Jim Blankenship



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Using-requireSessionWith-and-Need-Path-Exclusion-tp7586460.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.