shib SP 2.5.3 and apache 2.4 AccesControl require session

[Jehan Procaccia]

Le 26/01/2018 à 16:45, Cantor, Scott a écrit :
> I don't know anything about your intent, but you changed "don't require a login" (passive protection) to "require a login" (active protection), which is pretty different. Nothing you did, or would be likely to do, would impact the data showing up, particularly given it requiring a login. The changes are all around authorization rules.
I want users accessing my location /shibwayf/shibtest.pl to be required 
to login in order to get a REMOTE_USER = eppn
it works fine on my old server with
<Location /shibwayf>
  AuthType shibboleth
  ShibRequestSetting requireSession 0
  require shibboleth
</Location>

having on that location an index.html that contains a "connexion" link 
to a shibboleth session (lazzy session I supose) with hard coded IDP

[1] 
https://mysite.int.fr/*Shibboleth.sso/Login*?providerId=https://idp3.tem-tsp.eu/idp/shibboleth&target=https://mysite.int.fr/shibwayf/shibtest.pl

on the new server with apache 2.4 and more recent SP (2.5.3)

<Location /shibwayf>
  ShibRequireSession*On*
  AuthType shibboleth
  require shib-session
</Location>

with ShibRequireSession*On => *then I do have a redirect to the DS and 
be able to login, then my connexion link [1] appears and I am directly 
connected (session already done) , but still no REMOTE_USER a eppn value 
on the perl Env display
if I set  here ShibRequireSession*Off ( *to reflect**requireSession 0 on 
the old server config) , then I get a "Unauthorized" response :
"GET /shibwayf/ HTTP/1.1" *401*

I admit it's confusing and I am lost , probably a miss configuration 
somewhere, but I can't find where , apache Location ? shibboleth2.xml ?
defaults and directives changes may explain the difference between my 
old config and the new one
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
but I cannot find witch one ?

thanks for your advices.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180126/09a2cd33/attachment.html>