shibboleth 2.4 ds

[Peter Schober]

* Rod Widdowson <rdw at steadingsoftware.com> [2017-04-14 11:22]:
> You do need to make sure that the DS end points aren’t being protected by shib.  I don't speak apache too good, but 
>     <Location /shibboleth-sp>
>         AuthType None
>         Require all granted
>     </Location>
> 
> Doesn't look too good.

Setting the AuthType shouldn't be necessary, but the above literally
matches the second example from the httpd docs here:
http://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authtype

Note that with httpd2.4 (on a default Debian8 install) I had to wrap
such statements within an <RequireAll> directice in order for them to
become active. So it may just be an httpd configuration issue.

Making sure the request is not in fact proxied to some other resource
(indicated by your attempts to prevent proxying for the shib handler
and the DS base URL) would also be good, e.g. by checking access logs
on the proxied resource.
(Note that the EDS is only a few HTML elements plus included JS and
CSS. So you could also move the required bits to your proxied
resource if desired, jfyi.)

-peter