Shib, groups, external users ....

[Steven Carmody]

On 3/6/13 3:16 PM, Cantor, Scott wrote:
>
> At its core,<  2.4 really only allows require rules with an OR between
> them. Making AND work is a limited hack until you get to 2.4.
>
> Obviously whether that limitation matters is policy dependent, but it's
> kind of squishy to go down that road assuming you won't ever need require
> attribute foo AND require LDAP bar, because if you do, you're sunk.
>

It sounds all too easy to proceed from a mistaken assumption ...

Testing my understanding, with an example .... and what happens may 
depend on the order in which these plugins run ?

Shib provides EPPN value

mod_authnz_ldap does an ldap query, searching for EPPN value (how might 
it get thisvalue, since its coming from Shib), requesting group memberships

1) htaccess has

require EPPN value

in this case Shib will handle the Rule

2) htaccess has

require GROUP value

in this case ldap will handle the RUle (its the only one with the user's 
values)

OR... will the Shib plugin always return SUCCESS (because it has nothing 
to do), and this will trump whatever the ldap plugin returns

3) htaccess has

require EPPN value
require GROUP value

result is unpredictatable... ?