<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 24, 2015, at 10:38 AM, Peter Schober <<a href="mailto:peter.schober@UNIVIE.AC.AT" class="">peter.schober@UNIVIE.AC.AT</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">* Don Faulkner <<a href="mailto:donf@uark.edu" class="">donf@uark.edu</a>> [2015-03-24 16:17]:<br class="">
<blockquote type="cite" class="">So, here’s my idea. I’ll create a new URL route in Apache httpd, say<br class="">
/public/{whatever}, and proxy-rewrite that into the right part of<br class="">
the application. Then, I’ll tell the SP config that requests to<br class="">
/public/ should follow the following rules:<br class="">
1. If an authenticated shib-session already exists, use that.<br class="">
2. Otherwise, don’t contact an IdP. Instead, act as though we have a<br class="">
successful authentication and set REMOTE_USER=uid=“anonymous” (no<br class="">
other attributes)<br class="">
</blockquote>
<br class="">
Not requiring a session for a resource would give you that, but then<br class="">
REMOTE_USER will be unset (assuming you're mapping an available<br class="">
attribute to REMOTE_USER in the Shib SP first), not set to some static<br class="">
dummy value.<br class="">
<br class="">
I don't see how checking for unset request.getRemoteUser() is worse<br class="">
than checking for request.getRemoteUser() having a static dummy value.<br class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>It isn’t, but the application doesn’t work that way. :) It expects you to be authenticated. Apparently, the way you give *public* access to something is to give it to the “anonymous” user.</div>
<div><br class="">
</div>
<div>That works fine without SSO because there’s a way to encode the user into the URL. When you go to SSO, the app appears to ignore that part and relies on REMOTE_USER (or an attribute of our choice). Everyone, even “anonymous,” still has to be authenticated.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<blockquote type="cite" class="">The risk that I can see is that if a user then tries to hit a<br class="">
regular /webnow/ URL, they’re “authenticated” as anonymous. So we’d<br class="">
need to make sure the application knows that’s not allowed.<br class="">
</blockquote>
<br class="">
I don't understand the requirement. If I do have a session with your<br class="">
SP, and my attributes suffice to get me access, I should be able to<br class="">
access /public (because it is) and /whatever (because I satisfy the<br class="">
authz requriements).<br class="">
If I don't have a session with your SP I can only access /public but<br class="">
accessing something else would trigger SSO, either from your own code<br class="">
(if you implement it that way, using Lazy Sessions from the Shib SP)<br class="">
or from the webserver configuration (using "active protection" from<br class="">
the Shib SP).<br class="">
<br class="">
<blockquote type="cite" class="">If it is, could I also set a rule on the rest of the URL space that<br class="">
says if the shib-session is for the anonymous user, to destroy it<br class="">
and re-authenticate?<br class="">
</blockquote>
<br class="">
That's default behaviour once yuo drop the idea of setting a static<br class="">
dummy value to signify "no value". If I have no session or my<br class="">
attributes don't satisfy the authz requirements, I'll be asked to<br class="">
authenticate (if the server is configured as such).<br class="">
</div>
</blockquote>
<br class="">
</div>
<div>So, maybe the answer is to turn off shibboleth for /public, and somehow set REMOTE_USER (maybe via mod_rewrite?)</div>
<div><br class="">
</div>
<div>
<div class="">
<div id="signature-separator" style="line-height: 5px; color: rgb(136, 136, 136);" class="">
-- </div>
<div id="sig" style="margin: 6px 0px; padding: 8px; border-top-width: 1px; border-top-color: rgb(0, 0, 0); border-top-style: dashed; line-height: 15px; font-family: Tahoma, Geneva, sans-serif; color: rgb(190, 15, 52);" class="">
<table border="1" cellpadding="0" style="border: none;" class="">
<tbody class="">
<tr class="">
<td style="font-size: 12px; line-height: 15px; font-family: Monaco, 'Lucida Sans Typewriter', monospace;" class="">
<img width="43" height="43" border="0" moz-do-not-send="true" style="float: left; padding: 2px 6px 0px 0px;" apple-inline="yes" id="48292504-E867-4212-BF5D-F291F9005966" apple-width="yes" apple-height="yes" src="cid:288A22C7-AC41-4828-BBBF-144914CC3450@uark.edu" class=""></td>
<td style="font-size: 12px; line-height: 15px;" class="">Don Faulkner, CISSP | <a ?this.style.textdecoration?underline???none??="" href="http://security.uark.edu/" style="color: rgb(190, 15, 52); text-decoration: none;" class="">CISO</a> at the <a ?this.style.textdecoration?underline???none??="" href="http://www.uark.edu/" style="color: rgb(190, 15, 52); text-decoration: none;" class="">University
of Arkansas</a> <br class="">
<span style="font-family: Monaco, 'Lucida Sans Typewriter', monospace;" class="">contact>> </span><a ?this.style.textdecoration?underline???none??="" href="mailto:donf@uark.edu" style="color: rgb(190, 15, 52); text-decoration: none;" class="">donf@uark.edu</a> |
+1 (479) 575-5349 <br class="">
<span style="font-family: Monaco, 'Lucida Sans Typewriter', monospace;" class="">connect>> </span><a ?this.style.textdecoration?underline???none??="" href="http://www.facebook.com/uarkITS" style="color: rgb(190, 15, 52); text-decoration: none;" class="">uarkITS
on Facebook</a> | <a ?this.style.textdecoration?underline???none??="" href="http://twitter.com/uaits" style="color: rgb(190, 15, 52); text-decoration: none;" class="">@uaits</a> | <a ?this.style.textdecoration?underline???none??="" href="http://twitter.com/dfaulkner" style="color: rgb(190, 15, 52); text-decoration: none;" class="">@dfaulkner</a> </td>
</tr>
</tbody>
</table>
</div>
</div>
<br class="">
<div>
<blockquote type="cite" class=""></blockquote>
</div>
</div>
<br class="">
</body>
</html>