Return 401 on expired/missing session?

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-04-09 20:14]:
> > Is there an easy way to have mod_shib (or httpd) return, say, HTTP 401
> > instead of a redirect to the IDP (or SAMLDS) in case where no valid session
> > exists?
> 
> That's been left to the passive session feature, which leaves it up
> to the application. A passive session plus a static require rule
> would generally return a 403. That could probably be made more
> configurable as a response code vs. trying to bastardize what the
> requireSession feature does.

Ah, you mean something like this?

  AuthType shibboleth
  ShibRequestSetting requireSession false
  Require shib-attr eppn ~ ^.+$

I always thought I can't have require rules when not enforcing
sessions? I.e., with passive protection any authorization would have
to be performed within the application?

Anyway, I now have active protection on / (for browser access) and the
above for /api (meant only for the JS to access) and that seems to
work fine: The browser establishes an SP session before even loading
the JS, the JS then accesses the /api just fine, once the shib session
expires the XHRs to /api will get HTTP 401 from the server.

Thanks Scott and Jim!

-peter