Moodle with Shibboleth auth - can i protect content without accessing auth/shibboleth/index.php?

[Peter Schober]

* voyage_34 <stefanos.pliakos at gmail.com> [2014-01-15 13:33]:
> Hello to all! I'm getting straight to the point. This is the case:

Note the end of Moodle's auth/shibboleth/README.txt about where
questions should be sent.

> However, when i authenticate (successfully - user xyz) from Joomla and
> follow the link mentioned above to a moodle course, moodle does not
> recognize me as user xyz because I have not accessed the protected URL
> shib-sp2.com/auth/shibboleth/index.php. I tried to protect
> shib-sp2.com/course at apache configuration using:
> 
>         <Location /course>
>                 AuthType Shibboleth
>                 ShibRequestSetting requireSession 1
>                 require primary-affiliation xyz_user
>         </Location>
>  
> but it won't work (still moodle shows me as guest user). I still have to
> access auth/shibboleth/index.php so that moodle realizes I am user xyz. 

That's fine as far as Shibboleth is concerned (i.e., it will give you
a valid Shibboleth session) but if Moodle's session management is not
written to recognize that without accessing auth/shibboleth/ at some
point that's really an application issue, nothing Shibboleth can help
you with.
(The usual choice is doing integrations is either like this or using
Lazy Sessions. The former has the advantage of also allowing to
perform authorization in the webserver, which you can't do with lazy
sessions. But then Moodle would probably be able to do that itself.)

> Is there a way I can achieve this without accessing
> auth/shibboleth/index.php OR maybe can moodle redirect me to
> auth/shibboleth/index.php when i follow the link to course/view.php?id=24
> and then throw me back to the course?

Lukas will certainly know (having written the module, IIRC) but I
would think (I don't have access to Univie's shibbolized Moodle
installation anymore) that with proper ordering of auth methods within
Moodle it would cause exactly such a redirect when a protected
resource is being accessed.
Univie's Moodle is closed off entirely (i.e., Shib sessions are
already required for /) and I can't recall ever seeing this issue.

Though if Moodle doesn't keep track of the resource you were trying to
access (here: a specific course) I can see how the RelayState would be
wrong and people would end up at Moodle's home page by mistake (or
something like that).
(Often setting lazy sessions on the webserver's root will help with
that, not sure here, due to the way sessions are set up.)

> Using: Debian Wheezy, shibboleth IDP 2.2.1, shibboleth SP 2.5,

Since we're on the shib list here: You may want to consider upgrading
that IdP.

-peter