Lazy sessions and authorization (Drupal)

[Laas Toom]

Hello,

Is there a way to apply authorization when using lazy sessions?

This might sound ridiculous, but I need to protect a Drupal site based on two attributes:

    ShibRequireAll On
    require unscoped-affiliation member
    require homeOrganization example.org

I am using Drupal’s shib_auth module, which requires lazy sessions, but AFAIK the module automatically creates users from all Shibboleth users and gives them basic access, while I need to just deny access without even creating accounts.


What I have now is lazy sessions on / and then use:

    <LocationMatch “/drupal/shib_”>
       # above authorization requirements
    </LocationMatch>

This works to a degree - first-time users are effectively denied access, because Shibboleth blocks shib_auth from creating user accounts.

BUT, when an existing user looses privileges (say graduates and looses member affiliation) the user first gets a 403 error when first returning from IdP, but if she then manually returns to the root of the application, suddenly shib_auth recognizes the username and grants access, because Shibboleth fills in the attributes and does not authorize them.


Both the SP and the relevant IdP are under my control, so I am able to make adjustments if needed.

Best regards,
--
Laas Toom