lazy sessions and .htaccess

[Peter Schober]

* Bill Tantzen <tantz001 at umn.edu> [2019-12-18 15:42]:
> Specifically, what I am trying to accomplish is to be able to quickly add
> "require not ip xx.xx.xx" directives to an .htaccess file for a handful of
> locations.

FWIW, if an admin is able to do those changes I'd move all those into
the httpd configuration and disable htaccess globally. Saves httpd
from traversing file systems (possibly even slow network/remote ones)
looking for .htaccess files everywhere.
(Also makes for an easier audit what the current effective config is
without having to search all those files yourself.)

> If that works, and it's not too weird, I'm happy with it but you
> seem to hint that there is more than one way to do it.

If it works it works. Also seems to be more of an httpd question, less
of a Shibboleth one.

> I am also curious about what lazy sessions actually do; my
> application seems to work fine without them!  What is the upside to
> using them when they seem to do nothing!

With neither lazy sessions nor active protection (require something
specific, not "shibboleth") httpd wouldn't even call into the Shib SP
so you'd never see any attributes anywhere, even if you din't care
about access control enforced by the web server itself.

So the only way for "works fine without" to make sense (to me) is if
you have areas with active protection (that work).

-peter