Apache 2.4 vs 2.2 authz/authnz model

[Cantor, Scott]

On 3/15/16, 7:30 PM, "users on behalf of Phil Ehrens" <users-bounces at shibboleth.net on behalf of pehrens at ligo.caltech.edu> wrote:


>
>I assumed that there was an implicit requirement for a session,
>and that ShibRequireAll was necessary to make the shib module
>"care" about the external authnz.

No. That command is there to hack in "require all rules" semantics, and it doesn't even do that since it's specific to one module. I coded it under duress, Apache < 2.4 does not support "all" semantics.

Sessions are an unrelated issue and are not related to authz, other than the degenerate case of telling Apache to reject a request without one, and that's there because Shibboleth doesn't always populate REMOTE_USER. Most authn modules treat "require user" as the same as that concept. I had to create something separate to handle that case or Apache wouldn't understand that idea.

>I don't know poop about Shibboleth, and less so after half
>a decade of trying to get my head around it. And yet, here
>we are ;^)

I'm just warning you that the real answer to any deep question about Apache authz in 2.4 is that you'd have to try it and play with it, I don't know it very well.

>Just need to have authentication fail when no session exists, and
>authorization fail when the authnz_external script doesn't return
>a "0".

Don't know anything about a script case, but "require shib-session" should work in either version to enforce a session existing. But it will *not* get one created. If you want the module to step in and force a session up front, that's the requireSession setting, not a require rule. The require rules run too late for that to work alone.

>I don't understand the difference between requiring a session and
>failing if a session doesn't exist. Does the user experience differ?

Requiring a session in authz is a denial of access after the fact and is used when the session may not contain a user identity, so the only require rule you're trying to enforce is for a session, regardless of what's in it. That's a feature unique to this module, kind of.

To actually make a session happen up front, you need to tell the authentication step to enforce that with a content setting (requireSession). They go hand in hand but they aren't the same function. Just comes about because of Apache's design.

-- Scott