Apache 2.4 vs 2.2 authz/authnz model

[Phil Ehrens]

Cantor, Scott wrote:
> On 3/15/16, 5:53 PM, "users on behalf of Phil Ehrens" <users-bounces at shibboleth.net on behalf of pehrens at ligo.caltech.edu> wrote:
> 
> 
> 
> >I formerly used this construct to do shib authentication
> >and authnz_external group authorization in Apache 2.2:
> >
> >        ShibRequireAll On
> >        AuthzShibAuthoritative Off
> >        Require group foo
> 
> AuthType would also have to be set (in all versions).

Yes, of course.
 
> In your example, there's only one rule, so ShibRequireAll shouldn't have mattered either way.

I assumed that there was an implicit requirement for a session,
and that ShibRequireAll was necessary to make the shib module
"care" about the external authnz.

> 
> >Should I expect to get (approximately) the same behavior
> >with Apache 2.4 like this, without setting any special
> >Shibboleth flag?:
> >
> >        ShibRequestSetting requireSession 1
> >        <RequireAll>
> >          Require shib-session
> >          Require group foo
> >        </RequireAll>
> 
> I don't know the authz model in 2.4 very well, and less so
> nearly half a decade after I tried to support it, but it's close.

I don't know poop about Shibboleth, and less so after half
a decade of trying to get my head around it. And yet, here
we are ;^)

> I'm not handling "group" rules anymore, as the documentation notes.
> But that looks right to me from what little I know, as long as the
> module that handles group rules is in place.

The authnz_external Apache module handles the "group" in this case.
 
> I don't know exactly what you're trying to equate, I guess. The
> requirement for a session would be the same in both. ShibRequireAll
> doesn't require a session in 2.2 certainly, and that example alone
> would have failed any time a session didn't exist.

Just need to have authentication fail when no session exists, and
authorization fail when the authnz_external script doesn't return
a "0".

> So they're not exactly the same, no, but they differ mainly in aspects
> that are not authz related, just the SP session requirement feature.

I don't understand the difference between requiring a session and
failing if a session doesn't exist. Does the user experience differ?

-- 
Phil Ehrens <phil.ehrens at ligo.org> |              mm
The LIGO Laboratory, MS 100-36     |           /^(  )^\
California Institute of Technology |           \,(..),/
1200 East California Blvd.         |             V~~V
Pasadena, CA 91125 USA             | My gpg public key:
Phone:(626)395-8518                | http://www.imbe.net/peligo.asc