Lazy sessions and authorization (Drupal)

[Peter Schober]

* Laas Toom <Laas.Toom at ut.ee> [2013-10-25 16:10]:
> On 25.10.2013, at 15:36, Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> > * Laas Toom <Laas.Toom at ut.ee> [2013-10-25 14:17]:
> >> Is there a way to apply authorization when using lazy sessions?
> > 
> > Not with httpd directives, no.
> 
> But with Shibboleth XML directives this is possible?

No. Sorry if I phrased that to lead you to think that.

> Verified by experiment: do a manual login via /Shibboleth.sso/Login
> and only then open /drupal for the first time - logged in
> successfully.

The resource (Drupal) lives at /drupal in this example?

And this resource is available to anyone (unauthenticated) or only to
authenticated users? If the former it's working as expected, no? If
the latter, why use lazy sessions in the first place (if no
unauthenticated access is needed)?

Does Drupal (the software) not create and maintain its own PHP
session?

This all has very little to do with Shibboleth and very much to do
with your local software and deployment decisions. Without more
detailed info there's too much guesswork involved.

> I.e. there really is no single entry point to protect with forced session.
> 
> 
> > Note that at https://drupal.org/project/shib_auth they ask that
> > questions and support requests should be sent to their mailing list,
> > so I'd try that.
> 
> I will try that too, but the documentation also requires me to
> enable ShibUseHeaders which made me a bit wary of their advice and
> hoped somebody here has some experience.

If you have an issue with their documentation wouldn't it make sense
then to take that up with them?

But yes, there are ways around the REDIRECT_ prefixing mess when using
environment variables together with mod_rewite, without resorting to
HTTP request headers. There's a thread in the list archives (possibly
even involving Drupal) for that. If you can't find I can take a look.

That's then something which could be added to the shib_auth Drupal
module's documentation (even though this has nothing to do with the
module itself, or Drupal, for that matter).
-peter