Lazy Sessions and /secure

[Mr. Christopher Bland]

Hi All,

I am working with a Wordpress server on a RHEL 7 server running Apache 2.4.  I set up my site for lazy session.  I have the following in my shib.conf file

<Location />
  AuthType shibboleth
  ShibRequireSession Off
  ShibUseHeaders On
  Require shibboleth
</Location>

Since doing this Wordpress is requiring authentication where needed but I am not being require to have a session for /secure even though I have this also configured

<Location /secure>
  AuthType shibboleth
  ShibUseHeaders On
  ShibRequestSetting requireSession true
  require shib-session
</Location>

I have tried a few other settings but still not required to authenticate

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require shib-session
</Location>

I didn’t set up a different Session Initiator so I don’t think I need requireSessionWith.  I also didn’t set up a RequestMap thinking I should be able to accomplish this in the shib.conf file.

What has the rest of the community done?

Please advise,

-Chris