Lazy sessions and authorization (Drupal)

[Laas Toom]

On 04.11.2013, at 18:25, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/4/13, 11:17 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
> 
>> * Cantor, Scott <cantor.2 at osu.edu> [2013-11-04 17:09]:
>>> Saying "ignore unauthorized session" is the same as not having the
>>> authz rule there.
>> 
>> I'm /guessing/ the application refuses access altogether once
>> authenticated but not authorized, i.e., you can't even see publicly
>> (unauthenticated) visible content?
>> Maybe a local logout & return to the site could be initiated from a
>> session hook instead?
> 
> Yes, I would say if that's goal, that makes a lot more sense.

Basically, lets forget Drupal for the moment and consider a simple PHP script that relies on HTTP Basic Auth with .htpasswd specifically for this page. Anybody gets to view the page, but POSTing comments is allowed only if REMOTE_USER is set.
Essentially that means that application does not have any authz and Apache has to do both authn and authz.

In such a setup there are two groups of users: anonymous users and authorized users.


Now, if I replace the Basic Auth with Shibboleth, the first group is split into two: really unauthenticated users and those valid SSO users that should not get to POST comments. The third group is the same authz users as before who get POST access.

Without modifying the application, I don’t see how I could retain the above functinality. If I do not set any authorization in Shib, second group would get POST access. If I set appropriate rules, the second group is denied access. Even with the “OR NOT valid-user” setup, the second group would fall in between the rules, because they are valid-users, but not authorized.

> But I'm just saying you can't have static access control and then have a
> flag that says "or ignore it". That's the same as not having it. I don't
> see how you could ever distinguish the two groups.

I named it bad. What I meant was “Do not set ENV variables if not authorized” - essentially kicking the second group into being unauthenticated as far as this app is concerned.

I tried to set up a hack with mod_rewrite with RewriteConds to check authorization rules and then RewriteRule with [E:!REMOTE_USER] if the Conds did not match, but somehow that failed. I admit that my environment was quite complex with other rewrites etc and I should probably try this out in a clean and simple setup.


PS. I have already contacted shib_auth authors and will send them the patch when we think it is working reliably.

Best regards,
Laas Toom