apache 2.4 + shibboleth 2.5.5

[Peter Schober]

* NATHAN KLINGENSTEIN <ndk at sudonym.me> [2016-02-15 07:44]:
> Authorization and authentication were radically changed by Apache
> between 2.2 and 2.4.

Aw yes! E.g. we found that on 2.4 a seemingly inonocuous
directive to make sure attributes are available everywhere in the
vhost with the usual:

  <Location />
    AuthType shibboleth
    Require shibboleth
  </Location>

would sidestep any and all other existing requirements and rules for
specific locations/directories, even though those were surrounded
within RequireAll directives, etc.

Also 2.4's new "RequireAll" authz container must be the most
misleadingly named parameter ever. To quote its documentation:

  <RequireAll> and </RequireAll> are used to enclose a group of
  authorization directives of which none must fail and at least one must
  succeed in order for the <RequireAll> directive to succeed.

At least I read "All" to be different from "at least one"...
Also note that whether a module returns success, failure or a neutral
result (!) is not documented for most of the modules I looked at.

Fun times!
-peter