<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>This caused me a headache for a long long time.</div>
<div><br>
</div>
<div>The Location block directives override the .htaccess directives: http://httpd.apache.org/docs/2.2/sections.html#mergin</div>
<div><br>
</div>
<div>So the choices are:</div>
<ul>
<li>Use a location block in your apache conf for the more secured directory (may not want user accessing apache conf or continually needing to action requests on their behalf )</li><li>Use the initial directive in a Directory block instead of Location (but this may break things like mod_rewrite)</li><li>Use the XML permission format</li></ul>
<div>For the later option – you provide a fairly rudimentary Shibboleth setup in the Location block:</div>
<div>
<div><Location "/secure"></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
<div> Require valid-user</div>
<div> </Location></div>
</div>
<div><br>
</div>
<div>Then you need a .htaccess in the /secure directory to provide the following</div>
<div>ShibAccessControl /var/www/html/secure/.htaccess.xml</div>
<div><br>
</div>
<div>The you specific the account control in the .htaccess.xml - https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPXMLAccessControl</div>
<div><br>
</div>
<div>Then you repeat the .htaccess and .htaccess.xml steps for wherever you need to further restrict your options</div>
<div><br>
</div>
<div>As we couldn't use the first two options – have gone with the third option</div>
<div><br>
</div>
<div>Cheers, </div>
<div>Aaron</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Doug Pham <<a href="mailto:phamx039@umn.edu">phamx039@umn.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Thu, 26 Jan 2012 17:20:23 -0600<br>
<span style="font-weight:bold">To: </span><<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>More Secure Sub-directory<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
Hi There,
<div> In my shib.conf file I have the following:</div>
<div><font color="#222222" face="arial,sans-serif"><span style="white-space:nowrap">
<div><Location /secure></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
<div> require valid-user</div>
<div></Location></div>
<div><br>
</div>
<div> I want to make a specific directory underneath /secure directory more secured using a list in a .htaccess directory:</div>
<div><br>
</div>
<div>
<div>AuthType Shibboleth</div>
<div>ShibRequireSession On</div>
<div>Require user joe</div>
<div>SSLOptions +StrictRequire</div>
<div>SSLRequireSSL</div>
</div>
<div><br>
</div>
<div> This is not working. I was able to login after authenticated and I am not "joe". What am I missing?</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Doug</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</span></font></div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</span>
</body>
</html>