Apache 2.4 vs 2.2 authz/authnz model

[Cantor, Scott]

On 3/15/16, 5:53 PM, "users on behalf of Phil Ehrens" <users-bounces at shibboleth.net on behalf of pehrens at ligo.caltech.edu> wrote:



>I formerly used this construct to do shib authentication
>and authnz_external group authorization in Apache 2.2:
>
>        ShibRequireAll On
>        AuthzShibAuthoritative Off
>        Require group foo

AuthType would also have to be set (in all versions).

In your example, there's only one rule, so ShibRequireAll shouldn't have mattered either way.


>Should I expect to get (approximately) the same behavior
>with Apache 2.4 like this, without setting any special
>Shibboleth flag?:
>
>        ShibRequestSetting requireSession 1
>        <RequireAll>
>          Require shib-session
>          Require group foo
>        </RequireAll>

I don't know the authz model in 2.4 very well, and less so nearly half a decade after I tried to support it, but it's close.

I'm not handling "group" rules anymore, as the documentation notes. But that looks right to me from what little I know, as long as the module that handles group rules is in place.

I don't know exactly what you're trying to equate, I guess. The requirement for a session would be the same in both. ShibRequireAll doesn't require a session in 2.2 certainly, and that example alone would have failed any time a session didn't exist.

So they're not exactly the same, no, but they differ mainly in aspects that are not authz related, just the SP session requirement feature.

-- Scott