ShibDisable on breaks basic auth valid user
Description
Environment
CentOS 6.4 OpenSSL 1.0.1e
Attachments
Activity
Scott Cantor June 18, 2013 at 2:24 AM
Closing on release.
Scott Cantor June 14, 2013 at 6:25 PM
http://svn.shibboleth.net/view/cpp-sp?rev=3864&view=rev
Not as bad as I thought, luckily. This extends the ShibCompatValidUser fix to encompass require user rules, and adds a "shib-user" rule label for the original features.
The difference is that mod_shib allows require user ~ regex and mod_authz_user doesn't. So I have to make sure I still support that if the compat flag is off.
The patch should fix your original ruleset.
Scott Cantor June 14, 2013 at 5:58 PM
Thank you, you caught this before I shipped it still broken.
This fix unfortunately isn't going to be so simple, but I know what to fix now, so I don't need independent confirmation over the weekend about it.
gibsonb@imsweb.com June 14, 2013 at 5:54 PM
Correct I was using require user devusr
I can switch to using valid-user, and upon doing so it appears that my basic auth is working as intended now. I will post the trace in a new issue for SSI.
Thanks so much Scott!
Scott Cantor June 14, 2013 at 5:46 PM
Ok, I think I know why I was confused, you said "valid user", and I thought you meant "valid-user". The new setting has nothing to do with require user, it's only changing how require valid-user works.
There is a similar bug I didn't fix with "require user" and that's what I think you caught. Please confirm that you're not using "valid-user" but "user" in your rule.
Also, please open a separate bug if you could, with a trace of what happens with SSI with the disable option unset. That's unrelated to all this, and I don't want to conflate them.
I believe I can fix the "user" rule bug also, I'll check something in for you to try shortly.
I compiled mod_shib.cpp released to add ShibCompatValidUser which I set to On, and I use a valid user statement for a few websites that we don't use shibboleth on. I also have an issue where my Server Side includes break similar to what happened for the Apache error pages, same errors, however if I put ShibDisable On to try to mitigate that issue, my valid-user statements break as they did before the ShibCompatValidUser variable was implemented.