<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Le 19/09/2017 à 11:51, Peter Schober a écrit :<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">* Jacques Le Roux <a class="moz-txt-link-rfc2396E" href="mailto:jacques.le.roux@les7arts.com"><jacques.le.roux@les7arts.com></a> [2017-09-19 11:38]:
</pre>
<blockquote type="cite">
<pre wrap="">Actually I have no issues, I just want to be sure that by using the 2nd form
I will not get any troubles like mentioned in a warning near the link I
provided.
</pre>
</blockquote>
<pre wrap="">
It's not a question of what rule to use to achieve the same desired
result (you don't say what that is, specifically), as they are vastly
different, as I tried to point out (in addition to the documentation).
One merely makes recieved SAML attributes available as environment
variables, and nothing else. (What you do with those is up to you.)
The other prevents access to the server (well, to / and everything
below), and only allows it for authenticated subjects (though with no
real authorisation, "require valid-user" means authn == authz, which
almost never is a good model for access control).
</pre>
<blockquote type="cite">
<pre wrap="">Namely that by using the 2nd form I have not to worry about what the 1st form does:
<<Note that using a global rule as above will override and circumvent rules
applied in |<Directory>| blocks or in local htaccess files. This includes
both Shibboleth rules or rules for other authentication methods that might
be in use. The above should *only* be used when the entire server is
dedicated to hosting a single Shibboleth-enabled application that performs
its own authorization.>>
I'm 99% sure, just need the last 1% confirmed :)
</pre>
</blockquote>
<pre wrap="">
I have not seen that paragraph before (which isn't saying much) but if
that's the case you could still use Location-based directives to
actively protect any resources, whether using mod_shib or other
modules.
So what is is that you're asking? Are you afraid the server you're
adding a Shibboleth SP to may be using other modules for authorisation
(it's your server, so go check), </pre>
</blockquote>
No, there is no other modules for authorisation<br>
<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">or do you need to support .htaccess
files, potentially from untrusted users (i.e., some form of
self-service)? </pre>
</blockquote>
Nor<br>
<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">Again, whether you even allow htaccess files is up to
your and your httpd configuration.</pre>
</blockquote>
I don't need htaccess files
, I simply use a HTTPD config<br>
<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">Why are you considering adding the "authtype/require shibboleth" rule
to your server at all? </pre>
</blockquote>
Not at all, I was simply worried by using <code class="java plain"><Location
/><br>
<br>
</code>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">What do you intend to protect and how?</pre>
</blockquote>
Globally all the webapps in a HTTPD VirtualHost<br>
<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">If that's for your own code/application, then you can usually
integrate things in a way that uses active protection on only some of
the files, and then set up an application session in thise files based
off the Shib SP's session. (That would be an alternative to not/never
actively protect anything with Shib, but always initiate logins from
your own code.)</pre>
</blockquote>
Thanks I don't think I need to that, at least yet.<br>
I think you cleared the last 1% I was worrying about and will go
that way<br>
<br>
Jacques<br>
<blockquote type="cite"
cite="mid:20170919095142.n7ck4wlpy7raotug@aco.net">
<pre wrap="">-peter
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="150">
</pre>
</body>
</html>