Path access control, a bit better

[Cantor, Scott]

On 7/12/17, 6:58 PM, "users on behalf of Young, Darren" <users-bounces at shibboleth.net on behalf of Darren.Young at chicagobooth.edu> wrote:

> While on the case idea I turned up logging in native.logger and noticed
> the AccessControl bits being built were converting my settings to lower
> case, AllStaff became allstaff in the native.log file:

That is documented, path rules are case-insensitive.

> So I renamed all of the directories on disk (Windows Server 2012 R2) to be
> lower case and everything appears to be working. Does this make sense? And
> if the SP doesn¹t locate a path on disk does it default to a 403 access
> denied to the caller?

No. The SP knows nothing about what's on the disk, URL to file mapping is much later inside the web server.

> It appears the URL itself entering IIS can be mixed case, /secure/allstaff
> and /secure/AllStaff appear to be equal to the AccessControl element in
> the SP.

This has nothing to do with the AccessControl element. It knows nothing about the path. The policy is attached to settings based on path, and the path evaluation to determine the settings is documented as being case-insensitive. This is partly because Windows tends to have insensitive file system handling, and the RequestMap is only needed with IIS.

PathRegex supports case sensitivity, though it was also buggy in that regard until recently.

-- Scott