Shibboleth + Basic Auth in earlier versions of Apache (specifically 2.2)

[Cantor, Scott]

On 10/15/15, 1:00 PM, "users on behalf of Pottinger, Hardy J." <users-bounces at shibboleth.net on behalf of PottingerHJ at missouri.edu> wrote:



>Hi, I can see from the list archives that Apache basic authentication is known to not work quite correctly [1] with Shibboleth 2.5.2 out of the box.

On Apache 2.4 anyway.

> If you want to mix the two authentication methods, you must turn on ShibCompatValidUser. Which would be very helpful to me, if I were using Apache HTTPD 2.4. I'm not, I'm using 2.2.15 (the latest available in the RHEL repositories). And yet, I'm seeing similar behavior when trying to mix basic auth and Shib in the same vhost. So, right now, I'm asking my sysadmins to upgrade our HTTPD version to 2.4, so I can utilize the ShibCompatValidUser setting. But, I figured I'd at least ask if this is a known bug with the shib module for earlier versions of Apache?

No, not if other configuration problems aren't involved. Apache itself is not designed to handle this in older versions, and it works poorly in some scenarios. The SP documentation on htaccess usage describes reccommended steps to take on older versions to reduce conflicts in semantics and avoid some of them.

-- Scott