<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Nir,<div class=""><br class=""></div><div class="">I think the Apache rules are satisfy any by default. Require valid-user is getting satisfied, so the attribute requirement becomes irrelevant. Try removing that line instead, but leaving the desired require line for attributes.</div><div class=""><br class=""></div><div class=""><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig" class="">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig</a></div><div class=""><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess#NativeSPhtaccess-Apache2.4" class="">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess#NativeSPhtaccess-Apache2.4</a></div><div class=""><br class=""></div><div class="">Authorization and authentication were radically changed by Apache between 2.2 and 2.4.</div><div class=""><br class=""></div><div class="">Take care,</div><div class="">Nate.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 14, 2016, at 21:23, Shemer, Nir <<a href="mailto:nshemer@sonnet.ucla.edu" class="">nshemer@sonnet.ucla.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">
<div class="">
<div class="">Hello,</div>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class=""><br class="">
</div>
<div class="">We are trying to use shibboleth access rules for different web folders. We have installed SUSE Linux Enterprise Server 12 SP1 and we are running Apache 2.4 / Shibboleth 2.5.5.</div>
<div class="">We are trying to use shibboleth for access control for web folders on the web root. </div>
<div class="">
<div class="">We noticed that if we enter the following lines in /etc/apache2/conf.d/shib.conf it will invoke the shibboleth login screen when we try the root of the server (<a href="https://dev.sonnet.ucla.edu/" style="color: rgb(149, 79, 114);" class="">https://server-name.ucla.edu</a> )</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><Location /></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>AuthType shibboleth</div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>Require shibboleth</div>
<div class=""></Location></div>
</div>
<div class=""><br class="">
</div>
<div class="">But when we try to protect a web folder (no matter what we tried) it simply won’t invoke the shibboleth login screen</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><Location /protected-folder></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>AuthType shibboleth</div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>ShibRequestSetting requireSession true</div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>Require valid-user (or shibb-user) // it seems that ‘valid-user’ is deprecated as of shibboleth 2.5.x</div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>ShibUseHeaders On</div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span># require shib-attr <ORG_ATTRIBUTE> <a href="mailto:userid@ucla.edu" class="">userid@ucla.edu</a> (this one also does not work)</div>
<div class=""></Location></div>
</div>
<div class=""><br class="">
</div>
<div class="">It seems that there are quite some attributes changes from previous versions of the shibboleth.</div>
</div>
<div class="">Does anyone had setup shibboleth with this configuration?</div>
<div class=""><br class="">
</div>
<div class="">
<div id="" class="">
<div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif;" class="">Thanks, nir<o:p class=""></o:p></span></div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif;" class=""> </span></p><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 9pt; font-family: 'Courier New';" class=""></span></p>
</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</span>
</div>
-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>