AccessRule Not Working

[Cantor, Scott]

On 8/5/16 9:40 AM, Teresa Fasano wrote:
> Hi,
> I need to set an access rule on my SP service to disable access to users
> having the profile as a student.

If I had to guess the Apache require rule is probably taking precedence,
and I don't really remember how all that combines but would imagine it's
an OR. Stop using the RequestMap, and move the XML rule into a file and
reference it with the shib-plugin command. Combining Apache rules with
RequestMap use is a recipe for disaster. Pick one.


> In the config file of Apache I have:
> 
> <Location /path-notstudent>
>         AuthType shibboleth
>         ShibRequestSetting applicationId default

IIRC, that's a redundant command, I believe the default is always "default".

>         ShibRequestSetting requireSession 1
>         ShibRequireSession On

And those are definitely redundant with each other.

>         Require valid-user

And that is, I suspect, why it's letting people in.

-- Scott