Lazy sessions and authorization (Drupal)

[Laas Toom]

On 25.10.2013, at 17:24, Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>> wrote:

Verified by experiment: do a manual login via /Shibboleth.sso/Login
and only then open /drupal for the first time - logged in
successfully.

The resource (Drupal) lives at /drupal in this example?

Yes.

And this resource is available to anyone (unauthenticated) or only to
authenticated users? If the former it's working as expected, no? If
the latter, why use lazy sessions in the first place (if no
unauthenticated access is needed)?

The application must be visible to anyone, but authenticated users get write access.

Currently it is not behaving exactly as expected, because with lazy sessions users are logged in regardless if they have correct affiliation or not and without lazy sessions shib_auth does not initiate user session outside of the "/drupal/shib_*” path.


Does Drupal (the software) not create and maintain its own PHP
session?

It probably does, but from the module’s code it seems that it is up to  the appropriate modules to decide if the PHP session is a valid authenticated user session and shib_auth does this on every request depending on Shibboleth ENV variables (and if they are missing at that time, the user session is destroyed) and it does not preserve this decision in the session.


Basically, what I need is to find a way to ensure that either the user has required attributes or the Shibboleth session is not present at all.


I will consult shib_auth list to see if they come up with something, but I doubt that anybody would be willing to rewrite the module to remove lazy session requirement just for my sake.

PS. I have already managed to remove the REDIRECT_ prefix from variable names, so that is not a problem for me.

Best,
Laas Toom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131025/5a566477/attachment.html