From 6f40af8311a6f99bfb5fd2c6fc0b2a54be55dff2 Mon Sep 17 00:00:00 2001 From: Carla Schroder Date: Thu, 24 Mar 2016 10:04:31 -0700 Subject: [PATCH] update shibboleth for apache 2.4 --- .../user_auth_shibboleth.rst | 156 +++++++++--------- 1 file changed, 81 insertions(+), 75 deletions(-) diff --git a/admin_manual/enterprise_user_management/user_auth_shibboleth.rst b/admin_manual/enterprise_user_management/user_auth_shibboleth.rst index 624f129c5..79dff75d2 100644 --- a/admin_manual/enterprise_user_management/user_auth_shibboleth.rst +++ b/admin_manual/enterprise_user_management/user_auth_shibboleth.rst @@ -31,7 +31,7 @@ Apache Configuration ^^^^^^^^^^^^^^^^^^^^ This is an example configuration as installed and operated on a Linux server -running the Apache Web server. These configurations are highly operating system +running the Apache 2.4 Web server. These configurations are highly operating system specific and require a high degree of customization. The ownCloud instance itself is installed in ``/var/www/owncloud/``. The @@ -50,88 +50,24 @@ Further Shibboleth specific configuration as defined in # # Load the Shibboleth module. # - LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so - + LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so + # # Ensures handler will be accessible. # - Satisfy Any - Allow from all + AuthType None + Require all granted - + # # Configure the module for content. # - # Shibboleth is disabled for the following location to allow non - # Shibboleth webdav access - - Satisfy Any - Allow from all - AuthType None - Require all granted - - - # Shibboleth is disabled for the following location to allow public link - # sharing - - Satisfy Any - Allow from all - AuthType None - Require all granted - - - # Shibboleth is disabled for the following location - # to allow public gallery sharing - - Satisfy Any - Allow from all - AuthType None - Require all granted - - - # Shibboleth is disabled for the following location to allow public link - # sharing - - Satisfy Any - Allow from all - AuthType None - Require all granted - - - # Shibboleth is disabled for the following location to allow public link - # sharing - - Satisfy Any - Allow from all - AuthType None - Require all granted - - - # Shibboleth is disabled for the following location to allow public link - # sharing - - Satisfy Any - Allow from all - AuthType None - Require all granted - - + + # # Besides the exceptions above this location is now under control of # Shibboleth + # AuthType shibboleth ShibRequireSession On @@ -139,6 +75,76 @@ Further Shibboleth specific configuration as defined in ShibExportAssertion On require valid-user + + # + # Shibboleth is disabled for the following location to allow non + # shibboleth webdav access + # + + AuthType None + Require all granted + + + # + # Shibboleth is disabled for the following location to allow public link + # sharing + # + + AuthType None + Require all granted + + + # + # Shibboleth is disabled for the following location to allow public gallery + # sharing + # + + AuthType None + Require all granted + + + # + # Shibboleth is disabled for the following location to allow public link + # sharing + # + + AuthType None + Require all granted + + + # + # Shibboleth is disabled for the following location to allow public link + # sharing + # + + AuthType None + Require all granted + + + # + # Shibboleth is disabled for the following location to allow public link + # sharing + # + + AuthType None + Require all granted + Depending on the ownCloud Shibboleth app mode, you may need to revisit this configuration. @@ -163,7 +169,7 @@ Shibboleth session and allows you to login as an administrator and inspect the currently available Apache environment variables. Use this mode to set up the environment mapping for the other modes, and in case you locked yourself out of the system. You can also change the app mode and environment mappings by using -the ``occ`` command, eg.:: +the ``occ`` command, like this example on Ubuntu Linux:: $ sudo -u www-data php occ shibboleth:mode notactive $ sudo -u www-data php occ shibboleth:mapping --uid login @@ -202,7 +208,7 @@ variables for display name and email address. In ownCloud 8.1 the Shibboleth environment variable mapping was stored in ``apps/user_shibboleth/config.php``. This file was overwritten on upgrades, -preventing a seamless upgrade procedure. In ownCloud 8.2 the variables are +preventing a seamless upgrade procedure. In ownCloud 8.2+ the variables are stored in the ownCloud database, making Shibboleth automatically upgradeable. Shibboleth with Desktop and Mobile Clients