Faking authentication for a URL path

[Don Faulkner]

On Mar 24, 2015, at 10:38 AM, Peter Schober <peter.schober at UNIVIE.AC.AT<mailto:peter.schober at UNIVIE.AC.AT>> wrote:

* Don Faulkner <donf at uark.edu<mailto:donf at uark.edu>> [2015-03-24 16:17]:
So, here’s my idea. I’ll create a new URL route in Apache httpd, say
/public/{whatever}, and proxy-rewrite that into the right part of
the application. Then, I’ll tell the SP config that requests to
/public/ should follow the following rules:
1. If an authenticated shib-session already exists, use that.
2. Otherwise, don’t contact an IdP. Instead, act as though we have a
successful authentication and set REMOTE_USER=uid=“anonymous” (no
other attributes)

Not requiring a session for a resource would give you that, but then
REMOTE_USER will be unset (assuming you're mapping an available
attribute to REMOTE_USER in the Shib SP first), not set to some static
dummy value.

I don't see how checking for unset request.getRemoteUser() is worse
than checking for request.getRemoteUser() having a static dummy value.

It isn’t, but the application doesn’t work that way. :) It expects you to be authenticated. Apparently, the way you give *public* access to something is to give it to the “anonymous” user.

That works fine without SSO because there’s a way to encode the user into the URL. When you go to SSO, the app appears to ignore that part and relies on REMOTE_USER (or an attribute of our choice). Everyone, even “anonymous,” still has to be authenticated.

The risk that I can see is that if a user then tries to hit a
regular /webnow/ URL, they’re “authenticated” as anonymous. So we’d
need to make sure the application knows that’s not allowed.

I don't understand the requirement. If I do have a session with your
SP, and my attributes suffice to get me access, I should be able to
access /public (because it is) and /whatever (because I satisfy the
authz requriements).
If I don't have a session with your SP I can only access /public but
accessing something else would trigger SSO, either from your own code
(if you implement it that way, using Lazy Sessions from the Shib SP)
or from the webserver configuration (using "active protection" from
the Shib SP).

If it is, could I also set a rule on the rest of the URL space that
says if the shib-session is for the anonymous user, to destroy it
and re-authenticate?

That's default behaviour once yuo drop the idea of setting a static
dummy value to signify "no value". If I have no session or my
attributes don't satisfy the authz requirements, I'll be asked to
authenticate (if the server is configured as such).

So, maybe the answer is to turn off shibboleth for /public, and somehow set REMOTE_USER (maybe via mod_rewrite?)

--
[cid:288A22C7-AC41-4828-BBBF-144914CC3450 at uark.edu]     Don Faulkner, CISSP | CISO<http://security.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf at uark.edu<mailto:donf at uark.edu> | +1 (479) 575-5349
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150324/84c8c1d5/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 2ZYiQ.jpeg
Type: image/jpeg
Size: 2829 bytes
Desc: 2ZYiQ.jpeg
Url : http://shibboleth.net/pipermail/users/attachments/20150324/84c8c1d5/attachment.jpeg