apache 2.4 + shibboleth 2.5.5

[NATHAN KLINGENSTEIN]

Nir,

I think the Apache rules are satisfy any by default.  Require valid-user is getting satisfied, so the attribute requirement becomes irrelevant.  Try removing that line instead, but leaving the desired require line for attributes.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig>
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess#NativeSPhtaccess-Apache2.4 <https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess#NativeSPhtaccess-Apache2.4>

Authorization and authentication were radically changed by Apache between 2.2 and 2.4.

Take care,
Nate.

> On Feb 14, 2016, at 21:23, Shemer, Nir <nshemer at sonnet.ucla.edu> wrote:
> 
> Hello,
> 
> We are trying to use shibboleth access rules for different web folders. We have installed SUSE Linux Enterprise Server 12 SP1 and we are running Apache 2.4 / Shibboleth 2.5.5.
> We are trying to use shibboleth for access control for web folders on the web root. 
> We noticed that if we enter the following lines in /etc/apache2/conf.d/shib.conf it will invoke the shibboleth login screen when we try the root of the server (https://server-name.ucla.edu <https://dev.sonnet.ucla.edu/> )
> 
> <Location />
> AuthType shibboleth
> Require shibboleth
> </Location>
> 
> But when we try to protect a web folder (no matter what we tried) it simply won’t invoke the shibboleth login screen
> 
> <Location /protected-folder>
> AuthType shibboleth
> ShibRequestSetting requireSession true
> Require valid-user (or shibb-user)         // it seems that ‘valid-user’ is deprecated as of shibboleth 2.5.x
> ShibUseHeaders On
> # require shib-attr <ORG_ATTRIBUTE> userid at ucla.edu (this one also does not work)
> </Location>
> 
> It seems that there are quite some attributes changes from previous versions of the shibboleth.
> Does anyone had setup shibboleth with this configuration?
> 
> Thanks, nir
>  
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160214/dad325e6/attachment-0001.html>