<div dir="ltr">Gotcha. That makes sense. Thanks much! <div><br></div><div>I guess I was thrown off by the fact that that block existed in the apache22.config example config that comes with Shibboleth.<div><br></div><div><div>
#</div><div># Ensures handler will be accessible.</div><div>#</div><div><Location /Shibboleth.sso></div><div> Satisfy Any</div><div> Allow from all</div><div></Location></div></div><div><br></div><div>Do you think that's just an error or is that required when you start protecting resources that are not at the root as they do in that example config:</div>
<div><br></div><div><div>#</div><div># Configure the module for content.</div><div>#</div><div># You MUST enable AuthType shibboleth for the module to process</div><div># any requests, and there MUST be a require command as well. To</div>
<div># enable Shibboleth but not specify any session/access requirements</div><div># use "require shibboleth".</div><div>#</div><div><Location /secure></div><div> AuthType shibboleth</div><div> ShibRequestSetting requireSession 1</div>
<div> require valid-user</div><div></Location></div></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Nov 4, 2013 at 6:55 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 11/4/13, 6:48 PM, "Bradley Wagner" <<a href="mailto:bradley.wagner@hannonhill.com">bradley.wagner@hannonhill.com</a>><br>
wrote:<br>
<div class="im">>I just tried removing the:<br>
><br>
><Location /Shibboleth.sso><br>
> Require all granted<br>
></Location><br>
<br>
>altogether and everything worked.<br>
<br>
</div>That's what I would expect.<br>
<div class="im"><br>
>All URLs were protected by Shibboleth and proxied to my Tomcat app (once<br>
>a valid Shibb session was established) *except* for /Shibboleth.sso/*<br>
>even though I wasn't explicitly exposing those.<br>
><br>
>Is the Apache module smart enough to know how to do this on its own? This<br>
>is my entire working config at this point.<br>
<br>
</div>Yes. If a request comes in such that the "effective" handlerURL for it<br>
matches the request itself, then the check_user hook bails and just runs<br>
the handler directly. That's why I've never needed to specially handle it.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>