{"type":"doc","content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Apache 2.4 Support","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"You should review this page and the ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]},{"text":" page thoroughly because Apache 2.4 is much more complicated than earlier versions. In particular, if you're trying to combine Shibboleth with other authentication schemes (like Basic), you may need to enable the ","type":"text"},{"text":"ShibCompatValidUser","type":"text","marks":[{"type":"code"}]},{"text":" option, documented below.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Half of Shibboleth runs within the web server. For Apache, this half is implemented in a module called ","type":"text"},{"text":"mod_shib_13.so,","type":"text","marks":[{"type":"em"}]},{"text":" ","type":"text"},{"text":"mod_shib_20.so,","type":"text","marks":[{"type":"em"}]},{"text":" ","type":"text"},{"text":"mod_shib_22.so,","type":"text","marks":[{"type":"em"}]},{"text":" or ","type":"text"},{"text":"mod_shib_24.so","type":"text","marks":[{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"depending on the Apache version. Like all Apache modules, the initial configuration is controlled with Apache's configuration file(s), but one of the primary options there (normally implicit/defaulted) is to point the module at the overall SP configuration file ","type":"text"},{"text":"(","type":"text","marks":[{"type":"em"}]},{"text":"shibboleth2.xml","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2063695926"}}]},{"text":")","type":"text","marks":[{"type":"em"}]},{"text":" where a lot of the options not specific to Apache are controlled.","type":"text"}]},{"type":"paragraph","content":[{"text":"At runtime, the module has the ability to process both a variety of Apache commands and rules specified in the SP configuration and make sense of both. This allows for a choice of approaches based on the need for native integration with Apache or for portability between web servers. Native integration using Apache commands is the better choice and is more secure.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"d906d920-18d6-4c7b-bef0-1172d41196be"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"ec613ce6-ce15-4d0b-a2db-967822a9c112"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prepping Apache","type":"text"}]},{"type":"paragraph","content":[{"text":"It's critical that you correctly configure the virtual hosts you will be using with the SP module by setting the ","type":"text"},{"text":"ServerName","type":"text","marks":[{"type":"code"}]},{"text":" command to the appropriate value. With Apache 2.x, you use this command to establish the proper hostname as well as the logical scheme and port the virtual host appears to run on from the client's point of view. If you fail to perform this step, the redirects generated by the module will be incorrect and various problems will ensue. Other related commands (varying by version) include ","type":"text"},{"text":"UseCanonicalName","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"UseCanonicalPhysicalPort","type":"text","marks":[{"type":"code"}]},{"text":". Before you do anything with the SP, do the work to get these commands working for you to enable proper generation of redirects.","type":"text"}]},{"type":"paragraph","content":[{"text":"You do not ","type":"text"},{"text":"have","type":"text","marks":[{"type":"em"}]},{"text":" to set ","type":"text"},{"text":"UseCanonicalName On","type":"text","marks":[{"type":"code"}]},{"text":", but you usually should for two reasons:","type":"text"}]},{"type":"paragraph","content":[{"text":"First, it's usually necessary to ensure that the redirects generated by the module are not affected by the client's choice of name (e.g., via use of /etc/hosts to map a custom hostname to the server). Failure to do this will often result in requests to the IdP with an unregistered response location that will be rejected there. There are ways around this but they're beyond the scope of this topic and depend on the IdP's cooperation.","type":"text"}]},{"type":"paragraph","content":[{"text":"Second, it's ","type":"text"},{"text":"necessary","type":"text","marks":[{"type":"em"}]},{"text":" to enable this option if you plan to use the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" feature in the SP configuration. Failure to do so will render your system vulnerable to trivial attacks. If for some reason you don't want to turn the option on, do ","type":"text"},{"text":"NOT","type":"text","marks":[{"type":"strong"}]},{"text":" use the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" feature to determine how to protect content. Generally you don't have to use that feature with Apache and the coupling to the canonical name option is the main reason it's not recommended.","type":"text"}]},{"type":"paragraph","content":[{"text":"Finally, on non-Windows systems you should make sure Apache is configured in so-called \"worker\" mode, using the \"worker\" MPM, either via a setting in an OS-supplied file like ","type":"text"},{"text":"/etc/sysconfig/httpd","type":"text","marks":[{"type":"em"}]},{"text":" or in the Apache configuration directly. Many servers come incorrectly configured in \"prefork\" mode, which emulates Apache 1.3's process model and causes vastly greater resource usage inside the shibd daemon.","type":"text"}]},{"type":"paragraph","content":[{"text":"If you think, probably incorrectly, that you can't do this, then you are going to experience huge spikes in memory usage under load. To mitigate this, you can create a ","type":"text"},{"text":"stackSize","type":"text","marks":[{"type":"code"}]},{"text":" property in the appropriate ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334609"}}]},{"text":" element to shrink the default stack size for daemon threads to a manageable size. You may need to create that XML element, as it is normally defaulted. You can also control stack size through operating system options such as the ","type":"text"},{"text":"ulimit","type":"text","marks":[{"type":"em"}]},{"text":" command.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Loading the Module","type":"text"}]},{"type":"paragraph","content":[{"text":"Most of the primary options needed to make the module usable are compiled into the code when you build it. This allows the module to run silently in most cases simply by loading it (the exact path will vary):","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Apache 2.2 Example","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"LoadModule mod_shib /opt/shibboleth-sp/lib/shibboleth/mod_shib_22.so","type":"text"}]},{"type":"paragraph","content":[{"text":"You're free to load the module anywhere in your Apache configuration layout that you prefer. The software includes a number of template files, one for each Apache version, that include the command above, a useful ","type":"text"},{"text":"Alias","type":"text","marks":[{"type":"code"}]},{"text":" setup that allows the default error templates to access an example style sheet, and a simple ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" example that protects a single directory.","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"It's best if you put your own custom configuration rules in Apache configuration files that you control rather than relying on the template files supplied with the software, because those files are overwritten during updates.","type":"text"},{"type":"hardBreak"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Properly Routing Handler URLs","type":"text"}]},{"type":"paragraph","content":[{"text":"For certain Apache configurations, such as using the wsgi_module to run Python applications (like django), the URL paths that Shibboleth handlers rely on (e.g. /Shibboleth.sso, see ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334342"}}]},{"text":") may not get properly routed to mod_shib by Apache, because another module has already claimed that namespace. To ensure this routing, you will need to set a Location directive within Apache's configuration file specifying routing to mod_shib. For the default path used by the handler (","type":"text"},{"text":"/Shibboleth.sso","type":"text","marks":[{"type":"code"}]},{"text":"), this directive is:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Apache SetHandler","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n SetHandler shib\n","type":"text"}]},{"type":"paragraph","content":[{"text":"You would have to vary the location in this directive if you change the ","type":"text"},{"text":"handlerURL","type":"text","marks":[{"type":"code"}]},{"text":" attribute of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334342"}}]},{"text":" ","type":"text","marks":[{"type":"code"}]},{"text":"setting in ","type":"text"},{"text":"shibboleth2.xml","type":"text","marks":[{"type":"em"}]},{"text":", but this isn't common.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Global Options","type":"text"}]},{"type":"paragraph","content":[{"text":"There are a handful of global options that apply to the module's overall configuration and are usually left out in favor of the values generated at compile time. They also correspond to a number of ","type":"text"},{"text":"environment variables","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335293"}}]},{"text":" that can be used in place of commands. They are generally needed only when the software is run out of a different directory from the build path.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"5da50adb-39ea-401f-b9cc-126b2c0fd561"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"ShibPrefix","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[666.0]},"content":[{"type":"paragraph","content":[{"text":"Corresponds to ","type":"text"},{"text":"SHIBSP_PREFIX","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335293"}}]},{"text":" variable (typically only usable on Windows)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"ShibConfig","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[666.0]},"content":[{"type":"paragraph","content":[{"text":"Corresponds to ","type":"text"},{"text":"SHIBSP_CONFIG","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335293"}}]},{"text":" variable","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[93.0]},"content":[{"type":"paragraph","content":[{"text":"ShibSchemas","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[666.0]},"content":[{"type":"paragraph","content":[{"text":"Corresponds to ","type":"text"},{"text":"SHIBSP_SCHEMAS","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335293"}}]},{"text":" variable","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"There's an additional Apache 2.x-only environment variable called SHIBSP_APACHE_PREREQ, which can be set to the name of a module that needs to run before the authentication hook runs. This is an experimental setting that was created as a possible fix for issues with module order, in particular the setting of additional response headers for, e.g., cross-origin use cases. There has been little reproduction of these problems or any clear sign of what the solution is, and this option hasn't really gotten much testing.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Server / VirtualHost Options","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"1990869e-7fcd-44b5-9cad-1480b7b93bec"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"ShibURLScheme","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1356.0]},"content":[{"type":"paragraph","content":[{"text":"Apache 1.3 only: Controls the URL scheme Apache will report to modules, should reflect the logical value seen by clients from outside your network.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"ShibCompatValidUser On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1356.0]},"content":[{"type":"paragraph","content":[{"text":"Default is Off, matching the behavior prior to this command's existence. Addresses a conflict when using Shibboleth in conjunction with other auth/auth modules by restoring \"standard\" Apache behavior when processing the \"valid-user\" and \"user\" Require rules. See the ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]},{"text":" topic for more detail.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"AuthConfig Options","type":"text"}]},{"type":"paragraph","content":[{"text":"The rest of the options supported by the module are what Apache calls \"AuthConfig\" options. This means they are meant to appear inside Apache content-control sections like ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", or ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", or in ","type":"text"},{"text":".htaccess","type":"text","marks":[{"type":"code"}]},{"text":" files (if the \"AuthConfig\" override is enabled).","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Note that Apache has complex (and unclear at times) rules for combining settings across all those different sections. The SP itself doesn't impact these rules; Apache is doing all the merging and evaluation and the SP just performs based on the resulting merge. One particular quirk seems to be that mod_rewrite can cause problems with anything but ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"-based settings. It seems to ignore settings applied based on physical path when it creates subrequests, so the original request seems to have the intended settings, but the rewritten request doesn't.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"A summary of the various commands follows:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"82e80295-ae6b-4527-afed-0636c65f60a5"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"AuthType type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Partially activates the module when type is set to \"shibboleth\" (or \"basic\", see ShibBasicHijack below). Must be accompanied by a Require command. See ","type":"text"},{"text":"http://httpd.apache.org/docs/2.2/mod/core.html#authtype","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/2.2/mod/core.html#authtype"}}]},{"text":" (or equivalent for your Apache version).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"Require rule operands...","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Enables an authorization rule in the module. For complete details, see the sections below on authentication and authorization. Also see ","type":"text"},{"text":"http://httpd.apache.org/docs/2.2/mod/core.html#require","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/2.2/mod/core.html#require"}}]},{"text":" (or equivalent for your Apache version).","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Apache 2.4","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that the supported rules have changed somewhat for Apache 2.4 because of its API differences. Direct re-use of your configuration probably won't work if you move to Apache 2.4.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibRequestSetting setting value","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Allows any valid ","type":"text"},{"text":"content setting","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334723"}}]},{"text":" to be set or altered for the applicable request(s). This command takes two parameters, the name of the content setting, and the value to set it to. For boolean/flag options, you can use the exact values \"1\", \"true\", and \"On\" or the exact values \"0\", \"false\", and \"Off\". For complete details, see the section below on content settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibRequestUnset setting","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Allows a ","type":"text"},{"text":"content setting","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334723"}}]},{"text":" to be reverted to its default value at a particular point in the merging process that Apache carries out. There aren't a lot of cases where this has value, but in a few edge cases like requireSessionWith it can be useful.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibDisable On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"When enabled, this allows the module to short-circuit and ignore requests much faster than without the option set. This is useful for bypassing processing for high-traffic, public content.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibBasicHijack On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Allows for compatibility with extensive legacy mod_auth configurations by activating the module when AuthType is set to basic","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"AuthGroupFile filename","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Identifies a mod_auth-style file containing group membership information for simple access control needs. See ","type":"text"},{"text":"http://httpd.apache.org/docs/2.2/mod/mod_authz_groupfile.html#authgroupfile","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/2.2/mod/mod_authz_groupfile.html#authgroupfile"}}]},{"text":". On Apache 2.4, this command is no longer handled directly by the SP module.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibRequireAll On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Normally, Require rules are processed such that satisfying any one rule will grant access. Subject to certain constraints (see the ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]},{"text":" topic), turning this option on will change the behavior such that all rules must be satisfied.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Not supported on Apache 2.4+","type":"text"}]},{"type":"paragraph","content":[{"text":"This command is subsumed by Apache 2.4's own support for controlling authorization rule composition.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"AuthzShibAuthoritative On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"As explained in the ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]},{"text":" topic, this option controls the behavior of the module when it encounters Require rules it does not understand and ShibRequireAll is enabled. Defaults to \"On\". ","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Not supported on Apache 2.4+","type":"text"}]},{"type":"paragraph","content":[{"text":"This command is subsumed by Apache 2.4's own support for controlling authorization rule composition and dispatching of rules to specific modules.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibUseEnvironment On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to \"On\", this turns on the use of ","type":"text"},{"text":"environment variables","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335257"}}]},{"text":" to publish attributes to applications. This is strongly preferred over the header option.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibUseHeaders On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to \"Off\", this turns on the use of ","type":"text"},{"text":"request headers","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335257"}}]},{"text":" to publish attributes to applications. Use of this option should be avoided. Be sure to review the topic on ","type":"text"},{"text":"spoof checking","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335299"}}]},{"text":" if you enable it.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibAccessControl path to an authentication plug-in configuration file","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Enables the use of ","type":"text"},{"text":"XML Access Control rules","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334887"}}]},{"text":" for access control. This option can also be used in an .htaccess file. This allows non-root users to set ","type":"text"},{"text":"complex access control rules","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334887"}}]},{"text":" without a restart of the web server. The plug-in is loaded on every request, which allows on-the-fly changes of access control rules (though is less efficient if large rulesets are used).","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Apache 2.4","type":"text"}]},{"type":"paragraph","content":[{"text":"With Apache 2.4+ the ShibAccessControl command is not supported anymore. Instead use require shib-plugin path as is described in ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibExpireRedirects On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to \"On\". Addresses issues with some browsers, notably Firefox 5+, that cause redirects generated by the SP to be cached, resulting in various errors following the login process. This usually manifests as a message replay error at the IdP, caused by the original redirect to the IdP being replayed. This option is enabled by default, but the older behavior can be restored, causing the cache-related headers on redirects to be governed by standard Apache settings.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibCompatWith24 On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"This option can be enabled to up-level the syntax requirements for the Require rules supported by the SP into the form used with Apache 2.4. You can enable this option to help migrate rules into a form that will work on Apache 2.4 before actually upgrading to it. This minimizes the compatibility issues for an upgrade.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[348.0]},"content":[{"type":"paragraph","content":[{"text":"ShibRequestMapperAuthz On|Off","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f0f0f0","rowspan":1,"colwidth":[1284.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to \"On\". Controls whether or not access control plugins attached using the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" in shibboleth2.xml are supported or not. Because this is less efficient to support in Apache 2.4, this option is provided to decrease request processing time in the event that such plugins are not in use. Disabling this does not prevent other features of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" from being supported","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enabling the Module for Authentication","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Need AuthType and Require","type":"text"}]},{"type":"paragraph","content":[{"text":"You ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]},{"text":"MUST","type":"text","marks":[{"type":"strong"}]},{"text":" supply the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]},{"text":"AuthType","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]},{"text":"Require","type":"text","marks":[{"type":"code"}]},{"text":" commands at or above the \"level\" of the content you want to protect in the document tree, or the module won't run. You ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]},{"text":"CANNOT","type":"text","marks":[{"type":"strong"}]},{"text":" rely solely on the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" because of Apache's internal design.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#707070"}}]}]}]},{"type":"paragraph","content":[{"text":"One of the \"quirks\" (I would say \"bugs\") in Apache is that it requires a complicated set of inter-related general commands to be in place in order for an \"auth\" module to actually \"see\" a request. Just because you load the module doesn't mean Apache will ever call on it to do any work. This can make things confusing; if you see Apache just serving up content and the SP seems to be ignoring the requests, the lack of these commands in place is is usually the problem.","type":"text"}]},{"type":"paragraph","content":[{"text":"Specifically, you ","type":"text"},{"text":"MUST","type":"text","marks":[{"type":"strong"}]},{"text":" create a command pair of ","type":"text"},{"text":"AuthType","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"Require","type":"text","marks":[{"type":"code"}]},{"text":" for the content you want to protect, or the module will not run. There are normally a couple of different strategies for this.","type":"text"}]},{"type":"paragraph","content":[{"text":"If you're using the module to protect specific content on the server, and you expect the module to step in and force the user to login automatically, you can place the following commands inside any appropriate content block or ","type":"text"},{"text":".htaccess","type":"text","marks":[{"type":"code"}]},{"text":" file:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Enabling the Module for Specific Content","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"AuthType shibboleth\nShibRequestSetting requireSession 1\nRequire valid-user","type":"text"}]},{"type":"paragraph","content":[{"text":"The two generic commands around the middle one are Apache's way of signaling that you want the module to run, and that any authenticated user for which an identifier is set is acceptable. The middle setting tells the SP to perform authentication any time a session isn't already in place, which ensures that the authorization rule can be met.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that if you use a different ","type":"text"},{"text":"AuthType","type":"text","marks":[{"type":"code"}]},{"text":", or leave out either one of those general commands, various errors will result.","type":"text"}]},{"type":"paragraph","content":[{"text":"To exclude a specific path from the directory above add a Location override like this:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Exclude a directory from authentication","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"\n AuthType Shibboleth\n ShibRequestSetting requireSession false\n Require shibboleth\n ","type":"text"}]},{"type":"paragraph","content":[{"text":"Another common trick is to enable the module across an entire server or at least virtual host, but leave specific rules for authentication and access to commands in other places. This introduces a bit of inefficiency, but does simplify the rest of your configuration:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Enabling the Module Globally (Overrides other Authentication Rules)","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"\nAuthType shibboleth\nRequire shibboleth\n","type":"text"}]},{"type":"paragraph","content":[{"text":"The difference here is that unless some other option is introduced, the module won't actually do anything, but it's always going to be minimally active. The special keyword \"shibboleth\" on the ","type":"text"},{"text":"Require","type":"text","marks":[{"type":"code"}]},{"text":" command is a way of telling the module that it should be active, but not actually block any access by default.","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"Note that using a global rule as above will override and circumvent rules applied in ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" blocks or in local htaccess files. This includes both Shibboleth rules or rules for other authentication methods that might be in use. The above should ","type":"text"},{"text":"only","type":"text","marks":[{"type":"strong"}]},{"text":" be used when the entire server is dedicated to hosting a single Shibboleth-enabled application that performs its own authorization.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Authorization","type":"text"}]},{"type":"paragraph","content":[{"text":"The SP contains a plugin interface for Access Control and includes a pair of implementations, one that's portable and one that enables \"familiar\" use of the Apache ","type":"text"},{"text":"Require","type":"text","marks":[{"type":"code"}]},{"text":" command in the usual places, including ","type":"text"},{"text":".htaccess","type":"text","marks":[{"type":"code"}]},{"text":" files.","type":"text"}]},{"type":"paragraph","content":[{"text":"With Apache 2.4, the ","type":"text"},{"text":"ShibRequestMapperAuthz","type":"text","marks":[{"type":"code"}]},{"text":" command allows the portable option to be bypassed for efficiency if not used.","type":"text"}]},{"type":"paragraph","content":[{"text":"For details on the portable option, see the ","type":"text"},{"text":"XMLAccessControl","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334887"}}]},{"text":" topic.","type":"text"}]},{"type":"paragraph","content":[{"text":"For details on the ","type":"text"},{"text":".htaccess","type":"text","marks":[{"type":"code"}]},{"text":" option, see the ","type":"text"},{"text":"htaccess","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335056"}}]},{"text":" topic.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Content Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The SP supports an extensible set of ","type":"text"},{"text":"content settings","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334723"}}]},{"text":", properties that control how it interacts with requests and enforces various requirements.","type":"text"}]},{"type":"paragraph","content":[{"text":"On Apache, these settings can be controlled using either the ","type":"text"},{"text":"ShibRequestSetting","type":"text","marks":[{"type":"code"}]},{"text":" command (really more of a meta-command), or by attaching properties using the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" mechanism in the SP configuration. By default, the SP ships with the \"Native\" RequestMapper plugin enabled. This plugin is what permits settings to be attached using either the native Apache command, or the XML syntax.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use the ","type":"text"},{"text":"ShibRequestSetting","type":"text","marks":[{"type":"code"}]},{"text":" command, you simply add a pair of parameters with the name of the content setting and the value you want.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, to set ","type":"text"},{"text":"applicationId","type":"text","marks":[{"type":"code"}]},{"text":" to ","type":"text"},{"text":"foo","type":"text","marks":[{"type":"code"}]},{"text":", the command would be:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ShibRequestSetting applicationId foo","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Apache Takes Precedence","type":"text"}]},{"type":"paragraph","content":[{"text":"The Apache command will always take precedence over anything you put into the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":", so be careful if you combine the two (and be careful if you allow \"AuthConfig\" overrides, since that will allow control over SP behavior by anybody with the ability to control ","type":"text"},{"text":".htaccess","type":"text","marks":[{"type":"code"}]},{"text":" files. To prevent this outright, you can alter the plugin type to \"XML\" to prevent the ","type":"text"},{"text":"ShibRequestSetting","type":"text","marks":[{"type":"code"}]},{"text":" command from functioning.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The general use of Apache commands should be self-explanatory (or at least should be explained by reading/learning about Apache configuration). For more information about using the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" feature, refer to the ","type":"text"},{"text":"How to do Request Mapping in the SP","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065335006"}}]},{"text":" topic.","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Secure Use of the RequestMapper on Apache","type":"text"}]},{"type":"paragraph","content":[{"text":"Significant caution should be exercised when using the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334391"}}]},{"text":" with Apache. If you do so, you ","type":"text"},{"text":"MUST","type":"text","marks":[{"type":"strong"}]},{"text":" ensure that the ","type":"text"},{"text":"UseCanonicalName","type":"text","marks":[{"type":"code"}]},{"text":" command is ","type":"text"},{"text":"On","type":"text","marks":[{"type":"code"}]},{"text":" (it's usually not enabled by default). This is discussed above in the \"Prepping Apache\" section. While the mechanism is safe if the directions are followed, unless portability is a significant requirement it's a better idea to stick to Apache commands instead.","type":"text"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}