Lazy sessions and authorization (Drupal)

[Kristof Bajnok]

On 2013-10-25 16:18, Cantor, Scott wrote:
>> I will try that too, but the documentation also requires me to enable
>> ShibUseHeaders which made me a bit wary of their advice and hoped
>> somebody here has some experience.
> 
> If their code is reading headers only (which would be a bad thing), then
> that advice is certainly necessary.

PHP merges headers and environment into a single array ($_SERVER) and I
don't know any non-deprecated way to access the environment only.

The advice is there because so far we (the Drupal Shib module
developers) haven't implemented a more robust algorithm for accessing
the Shib SP attributes that works for both Windows and Unix and with and
without internal redirects. And because role assignment (thus
authorisation) is based on $_SERVER and re-evaluated during every page
access, mod_rewrite's renamed variables resulted in weird errors.

Anyone who can sort out mod_rewrite from their Drupal configuration, may
safely disable ShibUseHeaders. Most of the users can not.

Kristof