Question about "Enabling the Module Globally"

[Jacques Le Roux]

Le 19/09/2017 à 11:51, Peter Schober a écrit :
> * Jacques Le Roux <jacques.le.roux at les7arts.com> [2017-09-19 11:38]:
>> Actually I have no issues, I just want to be sure that by using the 2nd form
>> I will not get any troubles like mentioned in a warning near the link  I
>> provided.
> It's not a question of what rule to use to achieve the same desired
> result (you don't say what that is, specifically), as they are vastly
> different, as I tried to point out (in addition to the documentation).
> One merely makes recieved SAML attributes available as environment
> variables, and nothing else. (What you do with those is up to you.)
> The other prevents access to the server (well, to / and everything
> below), and only allows it for authenticated subjects (though with no
> real authorisation, "require valid-user" means authn == authz, which
> almost never is a good model for access control).
>
>> Namely that by using the 2nd form I have not to worry about what the 1st form does:
>>
>> <<Note that using a global rule as above will override and circumvent rules
>> applied in |<Directory>| blocks or in local htaccess files. This includes
>> both Shibboleth rules or rules for other authentication methods that might
>> be in use. The above should *only* be used when the entire server is
>> dedicated to hosting a single Shibboleth-enabled application that performs
>> its own authorization.>>
>>
>> I'm 99% sure, just need the last 1% confirmed :)
> I have not seen that paragraph before (which isn't saying much) but if
> that's the case you could still use Location-based directives to
> actively protect any resources, whether using mod_shib or other
> modules.
> So what is is that you're asking? Are you afraid the server you're
> adding a Shibboleth SP to may be using other modules for authorisation
> (it's your server, so go check),
No, there is no other modules for authorisation

> or do you need to support .htaccess
> files, potentially from untrusted users (i.e., some form of
> self-service)?
Nor

> Again, whether you even allow htaccess files is up to
> your and your httpd configuration.
I don't need htaccess files , I simply use a HTTPD config

> Why are you considering adding the "authtype/require shibboleth" rule
> to your server at all?
Not at all, I was simply worried by using |<Location />

|
> What do you intend to protect and how?
Globally all the webapps in a HTTPD  VirtualHost

> If that's for your own code/application, then you can usually
> integrate things in a way that uses active protection on only some of
> the files, and then set up an application session in thise files based
> off the Shib SP's session. (That would be an alternative to not/never
> actively protect anything with Shib, but always initiate logins from
> your own code.)
Thanks I don't think I need to that, at least yet.
I think you cleared the last 1% I was worrying about and will go that way

Jacques
> -peter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/e7af20c8/attachment.html>