update shibboleth for apache 2.4

admin_manual/enterprise_user_management/user_auth_shibboleth.rst

@@ -31,7 +31,7 @@ Apache Configuration
 ^^^^^^^^^^^^^^^^^^^^
 
 This is an example configuration as installed and operated on a Linux server
-running the Apache Web server. These configurations are highly operating system
+running the Apache 2.4 Web server. These configurations are highly operating system
 specific and require a high degree of customization.
 
 The ownCloud instance itself is installed in ``/var/www/owncloud/``.  The
@@ -50,88 +50,24 @@ Further Shibboleth specific configuration as defined in
 	#
 	# Load the Shibboleth module.
 	#
-	LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so
-
+	LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so
+	
 	#
 	# Ensures handler will be accessible.
 	#
 	<Location /Shibboleth.sso>
-	  Satisfy Any
-	  Allow from all
+	  AuthType None
+	  Require all granted
 	</Location>
-
+	
 	#
 	# Configure the module for content.
 	#
-	# Shibboleth is disabled for the following location to allow non
-	# Shibboleth webdav access
-	<Location ~ "/oc-shib/remote.php/nonshib-webdav">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
-	# Shibboleth is disabled for the following location to allow public link
-	# sharing
-	<Location ~
-	  "/oc-shib/(status.php$
-	  |index.php/s/
-	  |public.php$
-	  |cron.php$
-	  |core/img/
-	  |index.php/apps/files_sharing/ajax/publicpreview.php$
-	  |index.php/apps/files/ajax/upload.php$
-	  |apps/files/templates/fileexists.html$
-	  |index.php/apps/files/ajax/mimeicon.php$)">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
-	# Shibboleth is disabled for the following location 
-	# to allow public gallery sharing
-	<Location ~
-         "/oc-shib/(apps/gallery/templates/slideshow.html$
-         |index.php/apps/gallery/ajax/getimages.php
-         |index.php/apps/gallery/ajax/thumbnail.php
-         |index.php/apps/gallery/ajax/image.php)">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
-	# Shibboleth is disabled for the following location to allow public link
-	# sharing
-	<Location ~ "/oc-shib/.*\.css">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
-	# Shibboleth is disabled for the following location to allow public link
-	# sharing
-	<Location ~ "/oc-shib/.*\.js">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
-	# Shibboleth is disabled for the following location to allow public link
-	# sharing
-	<Location ~ "/oc-shib/.*\.woff ">
-	  Satisfy Any
-	  Allow from all
-	  AuthType None
-	  Require all granted
-	</Location>
-
+	
+	#
 	# Besides the exceptions above this location is now under control of
 	# Shibboleth
+	#
 	<Location /oc-shib>
 	  AuthType shibboleth
 	  ShibRequireSession On
@@ -139,6 +75,76 @@ Further Shibboleth specific configuration as defined in
 	  ShibExportAssertion On
 	  require valid-user
 	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow non
+	# shibboleth webdav access
+	#
+	<Location ~ "/oc-shib/remote.php/nonshib-webdav">
+	  AuthType None
+	  Require all granted
+	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow public link
+	# sharing
+	#
+	<Location ~ \
+	"/oc-shib/(status.php$\
+	|index.php/s/\
+	|public.php$\
+	|cron.php$\
+	|core/img/\
+	|index.php/apps/files_sharing/ajax/publicpreview.php$\
+	|index.php/apps/files/ajax/upload.php$\
+	|apps/files/templates/fileexists.html$\
+	|index.php/apps/files/ajax/mimeicon.php$\
+	|index.php/apps/files_sharing/ajax/list.php$\
+	|themes/\
+	|index.php/apps/files_pdfviewer/\
+	|apps/files_pdfviewer/)">
+	  AuthType None
+	  Require all granted
+	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow public gallery
+	# sharing
+	#
+	<Location ~ \
+	"/oc-shib/(index.php/apps/gallery/s/\
+	|index.php/apps/gallery/slideshow$\
+	|index.php/apps/gallery/.*\.public)">
+	  AuthType None
+	  Require all granted
+	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow public link
+	# sharing
+	#
+	<Location ~ "/oc-shib/.*\.css">
+	  AuthType None
+	  Require all granted
+	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow public link
+	# sharing
+	#
+	<Location ~ "/oc-shib/.*\.js">
+	  AuthType None
+	  Require all granted
+	</Location>
+	
+	#
+	# Shibboleth is disabled for the following location to allow public link
+	# sharing
+	#
+	<Location ~ "/oc-shib/.*\.woff">
+	  AuthType None
+	  Require all granted
+	</Location>
 
 Depending on the ownCloud Shibboleth app mode, you may need to revisit this
 configuration.
@@ -163,7 +169,7 @@ Shibboleth session and allows you to login as an administrator and inspect the
 currently available Apache environment variables. Use this mode to set up the 
 environment mapping for the other modes, and in case you locked yourself out of 
 the system. You can also change the app mode and environment mappings by using 
-the ``occ`` command, eg.::
+the ``occ`` command, like this example on Ubuntu Linux::
 
  $ sudo -u www-data php occ shibboleth:mode notactive
  $ sudo -u www-data php occ shibboleth:mapping --uid login
@@ -202,7 +208,7 @@ variables for display name and email address.
 
 In ownCloud 8.1 the Shibboleth environment variable mapping was stored in
 ``apps/user_shibboleth/config.php``. This file was overwritten on upgrades,
-preventing a seamless upgrade procedure. In ownCloud 8.2 the variables are
+preventing a seamless upgrade procedure. In ownCloud 8.2+ the variables are
 stored in the ownCloud database, making Shibboleth automatically upgradeable.
 
 Shibboleth with Desktop and Mobile Clients