How to bypass authentication for some specific directories

[John Dennis]

On 06/21/2016 07:20 AM, Peter Schober wrote:
> * Ram, Budh <budh.ram at sap.com> [2016-06-21 13:15]:
>> I am using Shibboleth SP for SSO implementation in my application (application is running on IIS7.5).
>> My application has two types of features 1) can be used without authentication 2) need authentication to use.
>> The code base for these two features is sometimes common.  Is there
>> any configuration available in SP which allow me to bypass the idp
>> authentication mechanism for some code directories?
>> If yes, then what is the configuration I need to do on SP side to
>> access the common code directories in both cases (with/without
>> login)?
>
> Then your own code will need to determine which case it is (whether a
> shib session and ABAC is required for access to be granted or not).
> In Shib speak that's passive protection, or "lazy sessions":
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
> In that mode you're responsible for initiating a session as per:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
> The bigger picture:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication

Another way to solve the problem is to keep the two parts of the 
application on different URL's and just protect one URL with SAML. I 
suspect that will be a much simpler and cleaner solution.


-- 
John