<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On 25.10.2013, at 17:24, Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<blockquote type="cite">* Laas Toom <<a href="mailto:Laas.Toom@ut.ee">Laas.Toom@ut.ee</a>> [2013-10-25 14:17]:<br>
<blockquote type="cite">Is there a way to apply authorization when using lazy sessions?<br>
</blockquote>
<br>
Not with httpd directives, no.<br>
</blockquote>
<br>
But with Shibboleth XML directives this is possible?<br>
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">No.
Sorry if I phrased that to lead you to think that.</span></blockquote>
</div>
<br>
<div><br>
</div>
<div>One question still: am I the only one that thinks that it could come in handy if there is a way to allow both unauth users and properly authorized users and the application could rest assured that if session is present, it is properly authorized?</div>
<div>Thsi way, with several such apps the authorization is centralized into HTTPD configuration and not distributed between apps.</div>
<div><br>
</div>
<div>Also, in my view, the "ShibRequestSetting requireSession” behaves somewhat counter-intuitive:</div>
<div><br>
</div>
<div>1) when set to 1, a session is initiated when not present, and all authorization is applied</div>
<div>2) when set to 0, a session is still “required”, and authorized, only not initiated</div>
<div><br>
</div>
<div>It seems that the setting should have been named ‘initiateSession’ or similar.</div>
<div><br>
</div>
<div><br>
</div>
<div>I think that ‘requireSession' sould behave more like this when authorization is not passed:</div>
<div><br>
</div>
<div>1) when set to “1”, the user is given a 403 error page</div>
<div>2) when set to “0”, the user session is not set up as if not given at all (perhaps with an indication of this in the ENV/logs for debugging)</div>
<div><br>
</div>
<div>I.e. the requirements are always applied (as currently), but authz failure is not hard fault when session is not required.</div>
<div><br>
</div>
<div>Of course, this can not be changed now, for backwards compatibility, but perhaps a new setting, say ‘ignoreUnauthzSession’, could be introduced that toggles this behavior?</div>
<div><br>
</div>
<div>Are there any downsides to this? Could it be considered a featurea request?</div>
<div><br>
</div>
<div>Best regards,</div>
<div>Laas Toom</div>
</body>
</html>