Lazy sessions and authorization (Drupal)

[Peter Schober]

* Laas Toom <Laas.Toom at ut.ee> [2013-10-25 14:17]:
> Is there a way to apply authorization when using lazy sessions?

Not with httpd directives, no.

> This might sound ridiculous, but I need to protect a Drupal site
> based on two attributes:
> 
>     ShibRequireAll On
>     require unscoped-affiliation member
>     require homeOrganization example.org

This seems like a weird/broken way of writing just:

  require affiliation member at example.org

Also the latter will prevent any unauthorized IdP from issuing member
in the scope "example.org" (with the Shib SP's default config), while
the former (your example) will not, unless you add custom rules to
your SP's attribute-policy.xml
If the IdP cannot send the latter format it should be fixed.

> What I have now is lazy sessions on / and then use:
> 
>     <LocationMatch “/drupal/shib_”>
>        # above authorization requirements
>     </LocationMatch>

Unrelated but note that this directive will also match
/foo/bar/drupal/shib_whatever/baz/baaz/quax
Probably unlikely to create problems here but Always Anchor Your
Regular Expressions.
 
> This works to a degree - first-time users are effectively denied
> access, because Shibboleth blocks shib_auth from creating user
> accounts.
> 
> BUT, when an existing user looses privileges (say graduates and
> looses member affiliation) the user first gets a 403 error when
> first returning from IdP, but if she then manually returns to the
> root of the application, suddenly shib_auth recognizes the username
> and grants access, because Shibboleth fills in the attributes and
> does not authorize them.

I'm not sure I understand. /drupal/shib_auth (or whatever) should be
the place where the Drupal application session is being created, based
on attributes supplied by the local SP, no? Then I shouldn't be able
to ever successfully create a session if access to /drupal/shib_auth
/requires/ attributes I don't have? But I'm not aware of the internal
workings of the shib_auth module, I haven't looked at it in years.

Note that at https://drupal.org/project/shib_auth they ask that
questions and support requests should be sent to their mailing list,
so I'd try that.
-peter