Question about "Enabling the Module Globally"

[Peter Schober]

* Jacques Le Roux <jacques.le.roux at les7arts.com> [2017-09-19 11:38]:
> Actually I have no issues, I just want to be sure that by using the 2nd form
> I will not get any troubles like mentioned in a warning near the link  I
> provided.

It's not a question of what rule to use to achieve the same desired
result (you don't say what that is, specifically), as they are vastly
different, as I tried to point out (in addition to the documentation).
One merely makes recieved SAML attributes available as environment
variables, and nothing else. (What you do with those is up to you.)
The other prevents access to the server (well, to / and everything
below), and only allows it for authenticated subjects (though with no
real authorisation, "require valid-user" means authn == authz, which
almost never is a good model for access control).

> Namely that by using the 2nd form I have not to worry about what the 1st form does:
> 
> <<Note that using a global rule as above will override and circumvent rules
> applied in |<Directory>| blocks or in local htaccess files. This includes
> both Shibboleth rules or rules for other authentication methods that might
> be in use. The above should *only* be used when the entire server is
> dedicated to hosting a single Shibboleth-enabled application that performs
> its own authorization.>>
> 
> I'm 99% sure, just need the last 1% confirmed :)

I have not seen that paragraph before (which isn't saying much) but if
that's the case you could still use Location-based directives to
actively protect any resources, whether using mod_shib or other
modules.
So what is is that you're asking? Are you afraid the server you're
adding a Shibboleth SP to may be using other modules for authorisation
(it's your server, so go check), or do you need to support .htaccess
files, potentially from untrusted users (i.e., some form of
self-service)? Again, whether you even allow htaccess files is up to
your and your httpd configuration.

Why are you considering adding the "authtype/require shibboleth" rule
to your server at all? What do you intend to protect and how?
If that's for your own code/application, then you can usually
integrate things in a way that uses active protection on only some of
the files, and then set up an application session in thise files based
off the Shib SP's session. (That would be an alternative to not/never
actively protect anything with Shib, but always initiate logins from
your own code.)

-peter