Lazy sessions and authorization (Drupal)

[Laas Toom]

On 25.10.2013, at 17:24, Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>> wrote:

* Laas Toom <Laas.Toom at ut.ee<mailto:Laas.Toom at ut.ee>> [2013-10-25 14:17]:
Is there a way to apply authorization when using lazy sessions?

Not with httpd directives, no.

But with Shibboleth XML directives this is possible?

No. Sorry if I phrased that to lead you to think that.


One question still: am I the only one that thinks that it could come in handy if there is a way to allow both unauth users and properly authorized users and the application could rest assured that if session is present, it is properly authorized?
Thsi way, with several such apps the authorization is centralized into HTTPD configuration and not distributed between apps.

Also, in my view, the "ShibRequestSetting requireSession” behaves somewhat counter-intuitive:

1) when set to 1, a session is initiated when not present, and all authorization is applied
2) when set to 0, a session is still “required”, and authorized, only not initiated

It seems that the setting should have been named ‘initiateSession’ or similar.


I think that ‘requireSession' sould behave more like this when authorization is not passed:

1) when set to “1”, the user is given a 403 error page
2) when set to “0”, the user session is not set up as if not given at all (perhaps with an indication of this in the ENV/logs for debugging)

I.e. the requirements are always applied (as currently), but authz failure is not hard fault when session is not required.

Of course, this can not be changed now, for backwards compatibility, but perhaps a new setting, say ‘ignoreUnauthzSession’, could be introduced that toggles this behavior?

Are there any downsides to this? Could it be considered a featurea request?

Best regards,
Laas Toom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131028/1f7d95c4/attachment-0001.html