FW: apache 2.4 + shibboleth 2.5.5

[Peter Schober]

* Shemer, Nir <nshemer at sonnet.ucla.edu> [2016-02-15 05:23]:
> We noticed that if we enter the following lines in
> /etc/apache2/conf.d/shib.conf it will invoke the shibboleth login
> screen when we try the root of the server
> (https://server-name.ucla.edu/> )
> 
> <Location />
> AuthType shibboleth
> Require shibboleth
> </Location>

As Scott said, that alone cannot cause the observed behaviour. 
The case I mentioned earlier was probably down to mixing new
configuration based on Shib (and Location directives) with legacy
configuration (using Directory directives) -- which you shouldn't and
is even pointed out in the Shib documentation (as well as httpd).

> But when we try to protect a web folder (no matter what we tried) it simply won’t invoke the shibboleth login screen
> 
> <Location /protected-folder>
> AuthType shibboleth
> ShibRequestSetting requireSession true
> Require valid-user (or shibb-user)         // it seems that ‘valid-user’ is deprecated as of shibboleth 2.5.x
> ShibUseHeaders On
> # require shib-attr <ORG_ATTRIBUTE> userid at ucla.edu (this one also does not work)
> </Location>

I'm pretty sure we did something like that w/o issues in 2.2, but with
2.4 I think most percieved weirdness is usually down to 2.4
authorization containers. E.g. to do something similar to what you're
trying to achieve above I ended up with this:

  <Location />
    <RequireAll>
      AuthType shibboleth
      Require shibboleth
      <RequireAny>
        # Some example rules
        require ip 127.0.0.0/24
        require ip ...
      </RequireAny>
    </RequireAll>
  </Location>

  <Location /Shibboleth.sso>
    Require all granted
  </Location>

  <Location /foo>
    AuthType shibboleth
    ShibRequestSetting requireSession true
    ShibRequestSetting <other stuff>
    <RequireAll>
      Require shib-attr affiliation member at example.org
      <RequireAny>
        # Other example rules
        require ip 10.0.0.0/8
        require ip ...
      </RequireAny>
    </RequireAll>
  </Location>

-peter