Interaction between Shib and basic (file) authn in Apache 2.4

[Cantor, Scott]

On 7/21/17, 10:18 AM, "users on behalf of Chris Reeves" <users-bounces at shibboleth.net on behalf of chris.reeves at york.ac.uk> wrote:

> If we add 'ShibCompatValidUser On' to the server configuration then this works as before:

That's the literal reason the command exists. The incompatibilities with Apache 2.4 emerged after 2.5 was released and the fix was to clone the Apache logic and add the command so that if it's enabled, the behavior will match expectations.

I would expect some of this will be cleaned up in a 3.0 because we'll probably literally drop the user rule from the module entirely and stay out of the picture. It's been left rotting for years in a mess of workarounds.

> ShibCompatValidUser should be turned on for compatibility.

I'd just term it "behavior in line with Apache expectations".

> I also understand the other, more detailed, docs regarding the difference
> in behaviour of valid-user with and without this option, although I had
> assumed that the use of ShibCompatValidUser would only be relevant when the
> module had been activated (i.e. AuthType shibboleth).

If it only mattered then, there would never have been a problem. Apache doesn't work like that in 2.4, modules hook specific keywords, and so having hooked "user" to add the regex and negation features, I had to keep doing that, but the SP's logic only works if there's a sesssion now, so it broke basic auth.

> I suppose what I've found confusing are the references to 'older behaviour',
> which I've interpreted as corresponding to the behaviour that I am observing
> on my current servers (when mod_shib is not activated), but which is clearly
> only referring to the previous behaviour *when mod_shib is activated*.

It means older behavior of mod_shib, I suppose, but I don't know which reference you mean.

> What is the expected behaviour when mod_shib is loaded, but not activated? On
> my current servers it doesn't interfere with basic authentication and allows
> users to log in, however on more recent servers it prevents authentication
> even when it isn't activated (unless ShibCompatValidUser is set to On).

If your current servers are 2.2 then you're comparing apples and oranges. 2.2 and 2.4 are so different they may as well not be the same software when it comes to authn/authz.

I think the piece you're missing is that I was forced by compatibility requirements to keep hooking user/group because I extended their syntax (which was also a bad idea). That's why I added the shib-user keyword. You basically should *not* use require user with mod_shib now. You can, but you shouldn't.

-- Scott