Making a public folder on a Shib protected website

[Gaddie, Herbert (Luke)]

Hi Mark, thanks for the response.


On 6/19/13 11:39 AM, "Mark Henshall" <Mark.Henshall at cancer.org.uk> wrote:


>I did this, and it worked:
>
><LocationMatch /NoAuth>
>  Satisfy Any
>  allow from All
></LocationMatch>

After trying that, I'm still getting the "Timeout, Back Button, or
Bookmark" error. Here's the relevant config I'm using:

        <Location />
		AuthType shibboleth
		ShibRequestSetting requireSession 1
		Require user [first set of users]
	</Location>
	<Location /updates/>
		AuthType shibboleth
		ShibRequestSetting requireSession 1
		Require user [second set of users]
	</Location>
	<LocationMatch /blog/community/feed/>
		Satisfy Any
		allow from All
	</LocationMatch>

As you can see, I've got no problem setting different access lists, I just
can't disable authentication altogether for whatever reason. Nothing is
turning up in the Shib or Apache logs that would indicate any issues. This
one really has me scratching my head.


>
>
>Quoting "Gaddie, Herbert (Luke)" <gaddie.3 at osu.edu>:
>
>> Thanks for the quick Response, Scott.
>>
>>
>> On 6/18/13 3:25 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>>
>>> On 6/18/13 3:07 PM, "Gaddie, Herbert (Luke)" <gaddie.3 at osu.edu> wrote:
>>>>
>>>> And would like to open a particular folder so that anyone can access
>>>>it,
>>>> or at the very least be able to protect it using only AuthType Basic:
>>>
>>> Those are slightly different goals because of issues with the software,
>>> depending on Apache version.
>>
>> For the sake of simplicity in this example, lets just leave it to being
>> able to disable authentication for this particular directory.
>>
>>>
>>>> Unfortunately, I've been unable to find a good way to do this. I've
>>>> attempted to use:
>>>> Satisfy Any
>>>> Allow from All
>>>> AllowOverride All
>>>
>>> There's an exclusion example in the wiki on the NativeSPApacheConfig
>>>page.
>>> To just open up access, set
>>>
>>> ShibRequestSetting requireSession false
>>>
>>> With your user rule up above, you'd have to override that also, and put
>>> require shibboleth in the subfolder.
>>
>> Following the example at
>> 
>>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
>> titled "Exclude a directory from authentication" doesn't seem to work
>>for
>> me.
>>
>> I'm using:
>>
>>        <Location /blog/community/feed/>
>> 		AuthType Shibboleth
>> 		ShibRequestSetting requireSession false
>> 		Require Shibboleth
>> 	</Location>
>>
>> When I do this, I get the "Timeout, Back Button, or Bookmark" error. It
>> might be worth noting that I'm trying to access this page using PHP
>>(using
>> Curl), so no credentials are being provided.
>>
>>>
>>> You can also use ShibDisable On to completely shut off the module for
>>>some
>>> content, and the rest of the settings are ignored.
>>
>> Oddly enough, when I try to use ShibDisable, apache gives me a 401
>> Authorization Required message. Any ideas?
>>
>>>
>>> For Basic-Auth, I would expect setting AuthType to basic in the
>>>subfolder
>>> would also work, provided an appropriate require rule is used, but that
>>> can be trickier.
>>>
>>> -- Scott
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>
>
>
>
>
>NOTICE AND DISCLAIMER
>This e-mail (including any attachments) is intended for the above-named
>person(s). If you are not the intended recipient, notify the sender
>immediately, delete this email from your system and do not disclose or
>use for any purpose.
>
>We may monitor all incoming and outgoing emails in line with current
>legislation. We have taken steps to ensure that this email and
>attachments are free from any virus, but it remains your responsibility
>to ensure that viruses do not adversely affect you.
>Cancer Research UK
>Registered charity in England and Wales (1089464), Scotland (SC041666)
>and the Isle of Man (1103)
>A company limited by guarantee.  Registered company in England and Wales
>(4325234) and the Isle of Man (5713F).
>Registered Office Address: Angel Building, 407 St John Street, London
>EC1V 4AD.
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>