Question about "Enabling the Module Globally"

[Peter Schober]

* Jacques Le Roux <jacques.le.roux at les7arts.com> [2017-09-19 09:25]:
> |<Location />|
> |AuthType shibboleth|
> |Require shibboleth|
> |</Location>
> 
> I guess it's different than
> 
> <Location />
>   AuthType shibboleth
>   ShibRequestSetting requireSession 1
>   require valid-user
> </Location>

Very. The latter actively prevents access to the whole vhost unless an
active session has been estblished ("requireSession" is set to
true). The former is merely a syntactical necessity for httpd to have
mod_shib "see" the request in order for it to provide any environment
variables set by mod_shib that may or may not exist yet.
I.e., the latter is access control, the former merely makes existing
session data avaiable to the server, but does not enforce anything.

> I mean the 2nd form does not "||Overrides other Authentication Rules", right ?

Not sure I understand. What is it you really want to know? What
combination with what other authz rules (from what modules) are you
having issues with?
-peter