Shibboleth SP - RequestMap requireSession false for query string value

[Ulrich Leodolter]

Hi, 

On Fri, 2014-02-14 at 15:01 +0000, Cantor, Scott wrote:
> On 2/14/14, 4:20 AM, "Ulrich Leodolter" <ulrich.leodolter at obvsg.at> wrote:
> >
> ><RequestMap applicationId="default">
> 
> You should not be mixing the RequestMap with Apache settings.
> 
> >Additionally i configured Apache as documented at
> >https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#
> >NativeSPApacheConfig-EnablingtheModuleforAuthentication
> 
> It's not "additionally", pick one, not both.
> 

I dropped the RequestMap totally.
The following minimal Apache settings work as expected.
But when i uncomment Location containing requireSessionWith
it stops working and /shib/TST/logout always requires a session.

---
LoadModule mod_shib /usr/lib/shibboleth/mod_shib_22.so

<Location /Shibboleth.sso>
  Satisfy Any
  Allow from all
</Location>

<Location /shib>
  AuthType shibboleth
  Require shibboleth
  ShibRequestSetting requireSession true
  Options ExecCGI FollowSymlinks
  ForceType application/x-httpd-cgi
</Location>

#<Location "/shib/TST">
#  ShibRequestSetting requireSessionWith test-idp
#</Location>

<Location "/shib/TST/logout">
  ShibRequestSetting requireSession false
</Location>
---


It seems requireSessionWith cannot be negated by requireSession.
I assumed it can be done this way because requireSessionWith
is the same as requireSession, except the SessionInitiator.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings

Is this a potential bug?

Tested using shibboleth-2.5.3 and apache-2.2.22.

Best regards
Ulrich