<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On 28.10.2013, at 15:58, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Of course, this can not be changed now, for backwards compatibility, but<br>
perhaps a new setting, say ŒignoreUnauthzSession¹, could be introduced<br>
that toggles this behavior?<br>
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">I'm
not considering anything until I have actual evidence that it doesn't</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">work
already.</span></blockquote>
</div>
<br>
<div>I tried the ‘OR NOT valid-user’ scheme and it did not work.</div>
<div><br>
</div>
<div>In essence there are 3 types of users:</div>
<div>1) unauthenticated users</div>
<div>2) authenticated, but not authorized users</div>
<div>3) fully authorized users.</div>
<div><br>
</div>
<div>IMHO it is currently impossible keep Shibboleth from setting the environment variables for the second user type, i.e. collapsing first two groups, so that there would be only unauthenticated users and fully authorized users. That is what I propposed with
the “IgnoreUnauthzSession” flag.</div>
<div><br>
</div>
<div>The OR NOT valid-user scheme denied access outright to the second group, while allowing both 1 and 3 groups.</div>
<div><br>
</div>
<div>Anyhow, I solven my current problem with modifying the shib_auth module so that it has single point of entry so that I can use strong session with authorization and anonymous people can access everything else.</div>
<div><br>
</div>
<div>Best regards,</div>
<div>Laas Toom</div>
</body>
</html>