Interaction between Shib and basic (file) authn in Apache 2.4

[Chris Reeves]

That's great, thanks Scott - that all makes a lot more sense now. We'll make
sure we include the migration of rules to the new syntax as part of the
upgrade.

I was planning to update the wiki to try and clarify, although I see you've
already made an edit. It does feel that there's still room for confusion (for
me, at least). I wonder if the description for the 'valid-user' and 'user'
rule types (and ShibCompatValidUser) needs to consider Apache version too -
would 2.6.0 (or 2.5.2) w/ Apache 2.2 require ShibCompatValidUser? I'm happy to
make edits to clarify if you can confirm that this is only required when
mod_shib is running inside Apache 2.4 (which sounds like it is probalby the
case).

Regards,
    Chris

On Fri 21 Jul 2017 at 15:37:04 +0100, Cantor, Scott wrote:
> On 7/21/17, 10:18 AM, Chris Reeves wrote:
> 
> > If we add 'ShibCompatValidUser On' to the server configuration then this
> > works as before:
> 
> That's the literal reason the command exists. The incompatibilities with
> Apache 2.4 emerged after 2.5 was released and the fix was to clone the
> Apache logic and add the command so that if it's enabled, the behavior will
> match expectations.
> 
> I would expect some of this will be cleaned up in a 3.0 because we'll
> probably literally drop the user rule from the module entirely and stay out
> of the picture. It's been left rotting for years in a mess of workarounds.
> 
> > ShibCompatValidUser should be turned on for compatibility.
> 
> I'd just term it "behavior in line with Apache expectations".
> 
> > I also understand the other, more detailed, docs regarding the difference
> > in behaviour of valid-user with and without this option, although I had
> > assumed that the use of ShibCompatValidUser would only be relevant when
> > the module had been activated (i.e. AuthType shibboleth).
> 
> If it only mattered then, there would never have been a problem. Apache
> doesn't work like that in 2.4, modules hook specific keywords, and so having
> hooked "user" to add the regex and negation features, I had to keep doing
> that, but the SP's logic only works if there's a sesssion now, so it broke
> basic auth.
> 
> > I suppose what I've found confusing are the references to 'older
> > behaviour', which I've interpreted as corresponding to the behaviour that
> > I am observing on my current servers (when mod_shib is not activated), but
> > which is clearly only referring to the previous behaviour *when mod_shib
> > is activated*.
> 
> It means older behavior of mod_shib, I suppose, but I don't know which
> reference you mean.
> 
> > What is the expected behaviour when mod_shib is loaded, but not activated?
> > On my current servers it doesn't interfere with basic authentication and
> > allows users to log in, however on more recent servers it prevents
> > authentication even when it isn't activated (unless ShibCompatValidUser is
> > set to On).
> 
> If your current servers are 2.2 then you're comparing apples and oranges.
> 2.2 and 2.4 are so different they may as well not be the same software when
> it comes to authn/authz.
> 
> I think the piece you're missing is that I was forced by compatibility
> requirements to keep hooking user/group because I extended their syntax
> (which was also a bad idea). That's why I added the shib-user keyword. You
> basically should *not* use require user with mod_shib now. You can, but you
> shouldn't.