Shib, groups, external users ....

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2013-03-06 21:16]:
> At its core, < 2.4 really only allows require rules with an OR between
> them. Making AND work is a limited hack until you get to 2.4.

Right, but that applies to all modules (and hence deployers intending
on using httpd that way) and is not a limitation of mod_shib. And most
modules don't even allow AND'ing rules in the first place.
So IMO it's more a case of mod_shib's superiority being downgraded to
the rest of the bunch, than an actual limitation.

> Obviously whether that limitation matters is policy dependent, but it's
> kind of squishy to go down that road assuming you won't ever need require
> attribute foo AND require LDAP bar, because if you do, you're sunk.

ACK.
-peter