Question about "Enabling the Module Globally"

[Jacques Le Roux]

Le 19/09/2017 à 11:06, Peter Schober a écrit :
> * Jacques Le Roux <jacques.le.roux at les7arts.com> [2017-09-19 09:25]:
>> |<Location />|
>> |AuthType shibboleth|
>> |Require shibboleth|
>> |</Location>
>>
>> I guess it's different than
>>
>> <Location />
>>    AuthType shibboleth
>>    ShibRequestSetting requireSession 1
>>    require valid-user
>> </Location>
> Very. The latter actively prevents access to the whole vhost unless an
> active session has been estblished ("requireSession" is set to
> true). The former is merely a syntactical necessity for httpd to have
> mod_shib "see" the request in order for it to provide any environment
> variables set by mod_shib that may or may not exist yet.
> I.e., the latter is access control, the former merely makes existing
> session data avaiable to the server, but does not enforce anything.
>
>> I mean the 2nd form does not "||Overrides other Authentication Rules", right ?
> Not sure I understand. What is it you really want to know? What
> combination with what other authz rules (from what modules) are you
> having issues with?
> -peter
Thanks Peter,

Actually I have no issues, I just want to be sure that by using the 2nd form I will not get any troubles like mentioned in a warning near the link  I 
provided.
Namely that by using the 2nd form I have not to worry about what the 1st form does:

<<Note that using a global rule as above will override and circumvent rules applied in |<Directory>| blocks or in local htaccess files. This includes 
both Shibboleth rules or rules for other authentication methods that might be in use. The above should *only* be used when the entire server is 
dedicated to hosting a single Shibboleth-enabled application that performs its own authorization.>>

I'm 99% sure, just need the last 1% confirmed :)

Jacques

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/11e63ccf/attachment.html>