Lazy sessions and authorization (Drupal)

[Laas Toom]

On 28.10.2013, at 15:58, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

Of course, this can not be changed now, for backwards compatibility, but
perhaps a new setting, say ŒignoreUnauthzSession¹, could be introduced
that toggles this behavior?

I'm not considering anything until I have actual evidence that it doesn't
work already.

I tried the ‘OR NOT valid-user’ scheme and it did not work.

In essence there are 3 types of users:
1) unauthenticated users
2) authenticated, but not authorized users
3) fully authorized users.

IMHO it is currently impossible keep Shibboleth from setting the environment variables for the second user type, i.e. collapsing first two groups, so that there would be only unauthenticated users and fully authorized users. That is what I propposed with the “IgnoreUnauthzSession” flag.

The OR NOT valid-user scheme denied access outright to the second group, while allowing both 1 and 3 groups.

Anyhow, I solven my current problem with modifying the shib_auth module so that it has single point of entry so that I can use strong session with authorization and anonymous people can access everything else.

Best regards,
Laas Toom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/5dbb22bb/attachment.html