Shib, groups, external users ....

[Cantor, Scott]

On 3/6/13 3:03 PM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>
>I'm pretty sure I've used Shib for authN and mod_authnz_ldap for
>authorization in the past. (Also I recall Wes Craig? of Umich having
>patches available for httpd for some of that).
>If that fits the picture I can try to look for any old configs but no
>promises, it's been many years since I've last used that.

That much should work, and I made adjustments to mod_shib to get it
behaving properly, but getting combinations of rules with certain behavior
between modules doesn't. So if you were to add a require rule that
mod_shib was meant to handle alongside the LDAP rules, there's a limit to
what you can get Apache to do.

At its core, < 2.4 really only allows require rules with an OR between
them. Making AND work is a limited hack until you get to 2.4.

Obviously whether that limitation matters is policy dependent, but it's
kind of squishy to go down that road assuming you won't ever need require
attribute foo AND require LDAP bar, because if you do, you're sunk.

-- Scott