comments on this request map

[Peter Schober]

* Doan, Tommy <tdoan at smu.edu> [2015-11-17 04:30]:
> <RequestMapper type="Native">
>   <RequestMap>
>     <!-- we cannot require a session at the root since doing so would protect the default document -->
>     <!-- instead we must allow anonymous access to the root and all exception paths, then protect everything else -->
>       <Host name="appx.college.edu" authType="shibboleth" requireSession="false">
>         <PathRegex regex="^index.*\.html" requireSession="false" />
>         <PathRegex regex="^content" requireSession="false" />
>         <PathRegex regex="^scripts" requireSession="false" />
>         <!-- if the requested path does not match a statement above, catch it with this statement -->
>         <PathRegex regex=".*" requireSession="true" />
>       </Host>
>   </RequestMap>
> </RequestMapper>

Obviously we can't say whether this is right for your specific
resources, and I do think at least with Apache httpd you can protect
everything and still make exceptions, but if the above works for you
it's probably OK. Are there no subdirectories or "deep links" in the
protected resource? I don't think Path extends over '/'s, but I may
misremember (and maybe it doesn't apply for PathRegex, I haven't
looked at that documentation).
-peter