comments on this request map

[Doan, Tommy]

I have a lot riding on getting this request map right, so I'm asking for feedback from you guys before I move forward.

I had originally intended to protect the entire host and then make a few path exceptions. However, I've learned that a link to the root folder (https://appx.college.edu/) is required to display some index pages anonymously, which does not work with the root protected. So with the request map shown below, I do not require a session at the host or for a list of path exceptions, but do protect all other pages and folders. This configuration appears to be functional, but comments and suggestions for improvement are welcome. Thanks very much!

This is for a Windows IIS 8.5 host running Shib SP 2.5.5.1.

<RequestMapper type="Native">
  <RequestMap>
    <!-- we cannot require a session at the root since doing so would protect the default document -->
    <!-- instead we must allow anonymous access to the root and all exception paths, then protect everything else -->
      <Host name="appx.college.edu" authType="shibboleth" requireSession="false">
        <PathRegex regex="^index.*\.html" requireSession="false" />
        <PathRegex regex="^content" requireSession="false" />
        <PathRegex regex="^scripts" requireSession="false" />
        <!-- if the requested path does not match a statement above, catch it with this statement -->
        <PathRegex regex=".*" requireSession="true" />
      </Host>
  </RequestMap>
</RequestMapper>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151117/83804837/attachment.html>