shib SP 2.5.3 and apache 2.4 AccesControl require session

[Jehan Procaccia]

Le 26/01/2018 à 18:44, Peter Schober a écrit :
> * Jehan Procaccia <jehan.procaccia at tem-tsp.eu> [2018-01-26 16:10]:
>> On my old server with shib SP 2.4.3 and apache 2.2.16-6
>> [...]
>> Now on my new server with shibboleth 2.5.3  and apache 2.4.18
> Now why would you build a /new/ server with an /obsolete/ Shib SP to
> begin with? (And with no way forward, probably?)
the default install "apt install libapache2-mod-shib2"
installed that version on my
# cat /etc/issue
Ubuntu 16.04.3 LTS \n \l
meanwhile I've been told to have a look at

https://tuakiri.ac.nz/confluence/display/Tuakiri/Install+Shibboleth+SP+on+Debian+Based+linux#InstallShibbolethSPonDebianBasedlinux-Installation

with pkg.switch.ch packages , I will .
>
>> but my perl script that returns shib vars , keeps showing REMOTE_USER empty,
> JFYI, there's no need for such scripts, and there hasn't been one in
> many years. You'll see REMOTE_USER in httpd's access log (lines that
> do not have " - - " will have the REMOTE_USER in there), you'll see
> successfully processed attributes in the SP's transaction.log and at
> the /Shibboleth.sso/Session handler, and skipped (e.g. unmapped)
> attributes in the SP's shibd.log.
you are right
/Shibboleth.sso/Session does show me

_Attributes_
*displayName*: 1 value(s)
*entitlement*: 7 value(s)
*eppn*: 1 value(s)

and apache logs
137.129.12.21 - procacci at int.fr [26/Jan/2018:19:17:32 +0100]

> The rest I can't explain either, obviously. Though statements like the
> following:
>
> * Jehan Procaccia <jehan.procaccia at tem-tsp.eu> [2018-01-26 18:14]:
>> I want users accessing my location /shibwayf/shibtest.pl to be required to
>> login in order to get a REMOTE_USER = eppn
>> it works fine on my old server with
>> <Location /shibwayf>
>>   AuthType shibboleth
>>   ShibRequestSetting requireSession 0
>>   require shibboleth
>> </Location>
> simply mean you'll have to have more/other configuration active
> elsewhere, as no version of the SP would require sessions with that
> configuration alone.
I want to have "lazzy session" , allowing a login page with both a link 
to a shibboleth connexion and still have the possibility to connect with 
the local auth scheme provided by the web app .

thanks .
>
> -peter


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180126/64d5e45e/attachment.html>