comments on this request map

[Doan, Tommy]

As a follow up for the list, this is the request map I intend to move forward with.

<RequestMapper type="Native">
  <RequestMap>
    <!-- we cannot require a session at the root since doing so would protect the default document -->
    <!-- instead we must allow anonymous access to the root and all exception paths, then protect everything else -->
      <Host name="appx.college.edu" authType="shibboleth" requireSession="false">
        <Path name="content" requireSession="false" />
        <Path name="scripts" requireSession="false" />
        <PathRegex regex="^index.*\.html" requireSession="false" />
        <!-- if the requested path does not match a statement above, catch it with this statement -->
        <PathRegex regex=".*" requireSession="true" />
      </Host>
  </RequestMap>
</RequestMapper>

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Doan, Tommy
Sent: Tuesday, November 17, 2015 9:04 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: comments on this request map

Thanks Peter. The IIS logs indicate that requests for the root folder are seen as "/", regardless of whether the Default Document feature is enabled for index.html. When I had requireSession="true" at the host level, the SP would not allow anonymous access to "/", obviously. Of course specific requests for appx.college.edu/index.html work fine under that configuration. 

So my challenge is to allow unprotected access to the root folder plus a few other paths, and then to protect everything else including subdirectories and deep links. 

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Tuesday, November 17, 2015 4:50 AM
To: users at shibboleth.net
Subject: Re: comments on this request map

* Doan, Tommy <tdoan at smu.edu> [2015-11-17 04:30]:
> <RequestMapper type="Native">
>   <RequestMap>
>     <!-- we cannot require a session at the root since doing so would protect the default document -->
>     <!-- instead we must allow anonymous access to the root and all exception paths, then protect everything else -->
>       <Host name="appx.college.edu" authType="shibboleth" requireSession="false">
>         <PathRegex regex="^index.*\.html" requireSession="false" />
>         <PathRegex regex="^content" requireSession="false" />
>         <PathRegex regex="^scripts" requireSession="false" />
>         <!-- if the requested path does not match a statement above, catch it with this statement -->
>         <PathRegex regex=".*" requireSession="true" />
>       </Host>
>   </RequestMap>
> </RequestMapper>

Obviously we can't say whether this is right for your specific resources, and I do think at least with Apache httpd you can protect everything and still make exceptions, but if the above works for you it's probably OK. Are there no subdirectories or "deep links" in the protected resource? I don't think Path extends over '/'s, but I may misremember (and maybe it doesn't apply for PathRegex, I haven't looked at that documentation).
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net