Shib, groups, external users ....

[Cantor, Scott]

On 3/7/13 1:51 PM, "Steven Carmody" <steven_carmody at brown.edu> wrote:

>Testing my understanding, with an example .... and what happens may
>depend on the order in which these plugins run ?

If it's an OR, order can't matter. If it's an AND, the order matters.

>Shib provides EPPN value
>
>mod_authnz_ldap does an ldap query, searching for EPPN value (how might
>it get thisvalue, since its coming from Shib), requesting group
>memberships

I assume it can construct filters based on environment values, but I have
no idea.

>1) htaccess has
>
>require EPPN value
>
>in this case Shib will handle the Rule
>
>2) htaccess has
>
>require GROUP value
>
>in this case ldap will handle the RUle (its the only one with the user's
>values)

You have to tell modules whether to be authoritative or not for decision
making because if they are, any unknown rule will cause it to fail. That's
why ANDs don't work, since the module can't tell whether it's the last one
to run or not, and can't assume that all the rules it doesn't understand
have been met.

Authoritative modules will assume that if they can't determine access the
result is a fail. Non-authoritative modules will return indeterminate so
the others will make the decision. If the semantics are OR, it works ok
because any of the modules that can run and decide will decide.

>OR... will the Shib plugin always return SUCCESS (because it has nothing
>to do), and this will trump whatever the ldap plugin returns

That depends on the commands set to control authoritative behavior.

>3) htaccess has
>
>require EPPN value
>require GROUP value
>
>result is unpredictatable... ?

Whether it's unpredictable depends on the semantics you have in mind.
That's the point, Apache doesn't know what you mean so unless you want OR,
which is how Apache is defined to work, don't do it.

-- Scott