<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">We’re deploying Perceptive ImageNow/WebNow (running on Tomcat 7), and I have a need to allow certain documents in the system to be publicly accessible without requiring the user to login.</div>
<div class=""><br class="">
</div>
<div class="">Prior to switching to SSO, this was being done by granting access to certain documents to a locally-defined “anonymous” user, and then hard-coding the anonymous user access into the URL. I’m told (though I haven’t thoroughly tested yet) that this
won’t work when SSO is turned on.</div>
<div class=""><br class="">
</div>
<div class="">So, here’s my idea. I’ll create a new URL route in Apache httpd, say /public/{whatever}, and proxy-rewrite that into the right part of the application. Then, I’ll tell the SP config that requests to /public/ should follow the following rules:</div>
<div class="">1. If an authenticated shib-session already exists, use that.</div>
<div class="">2. Otherwise, don’t contact an IdP. Instead, act as though we have a successful authentication and set REMOTE_USER=uid=“anonymous” (no other attributes)</div>
<div class=""><br class="">
</div>
<div class="">(#1 isn’t necessry, but it’s nice.)</div>
<div class="">The risk that I can see is that if a user then tries to hit a regular /webnow/ URL, they’re “authenticated” as anonymous. So we’d need to make sure the application knows that’s not allowed.</div>
<div class=""><br class="">
</div>
<div class="">Is it possible to do #2 as I described?</div>
<div class="">If it is, could I also set a rule on the rest of the URL space that says if the shib-session is for the anonymous user, to destroy it and re-authenticate?</div>
<div class=""><br class="">
</div>
<br class="">
<div class="">
<div id="signature-separator" style="line-height:5px; color: #888;" class="">-- </div>
<div id="sig" style="margin: 6px 0; padding: 8px; border-top: 1px #000 dashed; font: 12px/15px Tahoma, Geneva, sans-serif; color:#be0f34;" class="">
<table border="1" cellpadding="0" style="border:none;" class="">
<tbody class="">
<tr class="">
<td style="font: 12/15px Monaco, Lucida Sans Typewriter, monospace;" class=""><img src="http://goo.gl/2ZYiQ" width="43" height="43" border="0" moz-do-not-send="true" style="float:left; padding: 2px 6px 0 0;" class=""></td>
<td style="font: 12/15px Tahoma, Geneva, sans-serif;" class=""><span style="color: black;" class="">Don Faulkner, CISSP</span> |
<span class=""><a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="http://security.uark.edu/" class="">CISO</a> at the
<a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="http://www.uark.edu/" class="">
University of Arkansas</a></span> <br class="">
<span style="font-family: Monaco, Lucida Sans Typewriter, monospace; color: black;" class="">contact>>
</span><span style="" class=""><a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="mailto:donf@uark.edu" class="">donf@uark.edu</a> | +1 (479) 575-5349</span>
<br class="">
<span style="font-family: Monaco, Lucida Sans Typewriter, monospace; color: black;" class="">connect>>
</span><span style="" class=""><a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="http://www.facebook.com/uarkITS" class="">uarkITS on Facebook</a> |
<a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="http://twitter.com/uaits" class="">
@uaits</a> | <a onmouseover?this.style.textdecoration?underline??onmouseout?none??="" style="color:#be0f34; text-decoration:none;" href="http://twitter.com/dfaulkner" class="">
@dfaulkner</a> </span></td>
</tr>
</tbody>
</table>
</div>
</div>
<br class="">
</body>
</html>