<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On 25.10.2013, at 17:24, Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Verified by experiment: do a manual login via /Shibboleth.sso/Login<br>
and only then open /drupal for the first time - logged in<br>
successfully.<br>
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">The
resource (Drupal) lives at /drupal in this example?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</blockquote>
<div><br>
</div>
<div>Yes.</div>
<br>
<blockquote type="cite">And this resource is available to anyone (unauthenticated) or only to<br>
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">authenticated
users? If the former it's working as expected, no? If</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">the
latter, why use lazy sessions in the first place (if no</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">unauthenticated
access is needed)?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</blockquote>
<div><br>
</div>
<div>The application must be visible to anyone, but authenticated users get write access.</div>
<div><br>
</div>
<div>Currently it is not behaving exactly as expected, because with lazy sessions users are logged in regardless if they have correct affiliation or not and without lazy sessions shib_auth does not initiate user session outside of the "/drupal/shib_*” path.</div>
<div><br>
</div>
<br>
<blockquote type="cite">Does Drupal (the software) not create and maintain its own PHP<br>
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">session?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</blockquote>
<br>
</div>
<div>It probably does, but from the module’s code it seems that it is up to the appropriate modules to decide if the PHP session is a valid authenticated user session and shib_auth does this on every request depending on Shibboleth ENV variables (and if they
are missing at that time, the user session is destroyed) and it does not preserve this decision in the session.</div>
<div><br>
</div>
<div><br>
</div>
<div>Basically, what I need is to find a way to ensure that either the user has required attributes or the Shibboleth session is not present at all.</div>
<div><br>
</div>
<div><br>
</div>
<div>I will consult shib_auth list to see if they come up with something, but I doubt that anybody would be willing to rewrite the module to remove lazy session requirement just for my sake.</div>
<div><br>
</div>
<div>PS. I have already managed to remove the REDIRECT_ prefix from variable names, so that is not a problem for me.</div>
<div><br>
</div>
<div>Best,</div>
<div>Laas Toom</div>
</body>
</html>