Need Help Regarding Query Matching

[Cantor, Scott]

On 7/13/16, 12:21 PM, "users on behalf of Ram, Budh" <users-bounces at shibboleth.net on behalf of budh.ram at sap.com> wrote:

>    Yes I understand, but the requirement is like which I had explained to you. I did not
> find any other way instead of using query element, maybe I do not know all the options
> available in Shibboleth SP.

There is no other way, I'm simply saying that if you do it, the chances of having a secure system are very small IMHO.

> The same resource (directory on IIS) should be protected for some scenarios but needs to
> be unprotected in others.  From wiki I got this point of using query element and setting
> requiresession=false  and differentiate both cases.

Yes. It just really depends what that resource is doing, and there are a lot of ways to screw it up because parameters in queries can be very flexible. The SP does what it can, but this is very dependent on the application code and how it processes parameters.

> It would be of great help if you can suggest some better way to achieve it.

I'm saying the goal is inherently bad, not that there's a better way. The safer way to do this is by expressing different behaviors based on path.

-- Scott