Faking authentication for a URL path

[Don Faulkner]

We’re deploying Perceptive ImageNow/WebNow (running on Tomcat 7), and I have a need to allow certain documents in the system to be publicly accessible without requiring the user to login.

Prior to switching to SSO, this was being done by granting access to certain documents to a locally-defined “anonymous” user, and then hard-coding the anonymous user access into the URL. I’m told (though I haven’t thoroughly tested yet) that this won’t work when SSO is turned on.

So, here’s my idea. I’ll create a new URL route in Apache httpd, say /public/{whatever}, and proxy-rewrite that into the right part of the application. Then, I’ll tell the SP config that requests to /public/ should follow the following rules:
1. If an authenticated shib-session already exists, use that.
2. Otherwise, don’t contact an IdP. Instead, act as though we have a successful authentication and set REMOTE_USER=uid=“anonymous” (no other attributes)

(#1 isn’t necessry, but it’s nice.)
The risk that I can see is that if a user then tries to hit a regular /webnow/ URL, they’re “authenticated” as anonymous. So we’d need to make sure the application knows that’s not allowed.

Is it possible to do #2 as I described?
If it is, could I also set a rule on the rest of the URL space that says if the shib-session is for the anonymous user, to destroy it and re-authenticate?


--
[http://goo.gl/2ZYiQ]   Don Faulkner, CISSP | CISO<http://security.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf at uark.edu<mailto:donf at uark.edu> | +1 (479) 575-5349
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150324/53c732e3/attachment.html