Faking authentication for a URL path

[Peter Schober]

* Don Faulkner <donf at uark.edu> [2015-03-24 16:17]:
> So, here’s my idea. I’ll create a new URL route in Apache httpd, say
> /public/{whatever}, and proxy-rewrite that into the right part of
> the application. Then, I’ll tell the SP config that requests to
> /public/ should follow the following rules:
> 1. If an authenticated shib-session already exists, use that.
> 2. Otherwise, don’t contact an IdP. Instead, act as though we have a
> successful authentication and set REMOTE_USER=uid=“anonymous” (no
> other attributes)

Not requiring a session for a resource would give you that, but then
REMOTE_USER will be unset (assuming you're mapping an available
attribute to REMOTE_USER in the Shib SP first), not set to some static
dummy value.

I don't see how checking for unset request.getRemoteUser() is worse
than checking for request.getRemoteUser() having a static dummy value.

> The risk that I can see is that if a user then tries to hit a
> regular /webnow/ URL, they’re “authenticated” as anonymous. So we’d
> need to make sure the application knows that’s not allowed.

I don't understand the requirement. If I do have a session with your
SP, and my attributes suffice to get me access, I should be able to
access /public (because it is) and /whatever (because I satisfy the
authz requriements).
If I don't have a session with your SP I can only access /public but
accessing something else would trigger SSO, either from your own code
(if you implement it that way, using Lazy Sessions from the Shib SP)
or from the webserver configuration (using "active protection" from
the Shib SP).

> If it is, could I also set a rule on the rest of the URL space that
> says if the shib-session is for the anonymous user, to destroy it
> and re-authenticate?

That's default behaviour once yuo drop the idea of setting a static
dummy value to signify "no value". If I have no session or my
attributes don't satisfy the authz requirements, I'll be asked to
authenticate (if the server is configured as such).
-peter