<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>I only just realised that I had a slight woops in my config I posted – didn't want to get anyone confused when googling or anything</div>
<div><br>
</div>
<div>The location section should not have require valid-user but require shibboleth. Otherwise require valid-user will override any further restrictions. Sorry if that is what wasn't working for you there Doug.</div>
<div><br>
</div>
<div>
<div class="im">
<div><Location "/secure"></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
</div>
<div> Require shibboleth</div>
<div> </Location></div>
</div>
<div><br>
</div>
<div>Cheers</div>
<div>Aaron</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Aaron Roots <<a href="mailto:aaron.roots@deakin.edu.au">aaron.roots@deakin.edu.au</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Sun, 29 Jan 2012 11:12:07 +0000<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: More Secure Sub-directory<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Hey Doug,</div>
<div><br>
</div>
<div>Am happy to help out more – but will need to see some of the config you are trying to use</div>
<div><br>
</div>
<div>Cheers</div>
<div>Aaron</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Doug Pham <<a href="mailto:phamx039@umn.edu">phamx039@umn.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 27 Jan 2012 11:56:40 -0600<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: More Secure Sub-directory<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
Aaron,
<div> I tried this but still not working for me. It does not seem like the directive is being executed.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Doug<br>
<br>
<div class="gmail_quote">On Thu, Jan 26, 2012 at 5:51 PM, Aaron Roots <span dir="ltr">
<<a href="mailto:aaron.roots@deakin.edu.au">aaron.roots@deakin.edu.au</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-size:14px;font-family:Calibri,sans-serif;word-wrap:break-word">
<div>This caused me a headache for a long long time.</div>
<div><br>
</div>
<div>The Location block directives override the .htaccess directives: <a href="http://httpd.apache.org/docs/2.2/sections.html#mergin" target="_blank">http://httpd.apache.org/docs/2.2/sections.html#mergin</a></div>
<div><br>
</div>
<div>So the choices are:</div>
<ul>
<li>Use a location block in your apache conf for the more secured directory (may not want user accessing apache conf or continually needing to action requests on their behalf )</li><li>Use the initial directive in a Directory block instead of Location (but this may break things like mod_rewrite)</li><li>Use the XML permission format</li></ul>
<div>For the later option – you provide a fairly rudimentary Shibboleth setup in the Location block:</div>
<div>
<div class="im">
<div><Location "/secure"></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
</div>
<div> Require valid-user</div>
<div> </Location></div>
</div>
<div><br>
</div>
<div>Then you need a .htaccess in the /secure directory to provide the following</div>
<div>ShibAccessControl /var/www/html/secure/.htaccess.xml</div>
<div><br>
</div>
<div>The you specific the account control in the .htaccess.xml - <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPXMLAccessControl" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPXMLAccessControl</a></div>
<div><br>
</div>
<div>Then you repeat the .htaccess and .htaccess.xml steps for wherever you need to further restrict your options</div>
<div><br>
</div>
<div>As we couldn't use the first two options – have gone with the third option</div>
<div><br>
</div>
<div>Cheers, </div>
<div>Aaron</div>
<div><br>
</div>
<span>
<div style="border-right:medium none;padding-right:0in;padding-left:0in;padding-top:3pt;text-align:left;font-size:11pt;border-bottom:medium none;font-family:Calibri;border-top:#b5c4df 1pt solid;padding-bottom:0in;border-left:medium none">
<span style="font-weight:bold">From: </span>Doug Pham <<a href="mailto:phamx039@umn.edu" target="_blank">phamx039@umn.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Thu, 26 Jan 2012 17:20:23 -0600<br>
<span style="font-weight:bold">To: </span><<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>More Secure Sub-directory<br>
</div>
<div><br>
</div>
<blockquote style="BORDER-LEFT:#b5c4df 5 solid;PADDING:0 0 0 5;MARGIN:0 0 0 5">
<div>
<div class="h5">Hi There,
<div> In my shib.conf file I have the following:</div>
<div><font color="#222222" face="arial,sans-serif"><span style="white-space:nowrap">
<div><Location /secure></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
<div> require valid-user</div>
<div></Location></div>
<div><br>
</div>
<div> I want to make a specific directory underneath /secure directory more secured using a list in a .htaccess directory:</div>
<div><br>
</div>
<div>
<div>AuthType Shibboleth</div>
<div>ShibRequireSession On</div>
<div>Require user joe</div>
<div>SSLOptions +StrictRequire</div>
<div>SSLRequireSSL</div>
</div>
<div><br>
</div>
<div> This is not working. I was able to login after authenticated and I am not "joe". What am I missing?</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Doug</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</span></font></div>
</div>
</div>
<div class="im">-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</span></div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</span></div>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</span>
</body>
</html>